Chrome Will Mark Every HTTP Page Not Secure in July

What was announced

Google announced yesterday that from Chrome 68, due in July, every page loaded over plain HTTP will be marked Not secure in the address bar.

At the moment, Chrome shows that label on an HTTP page only once a visitor begins typing into a form, or on any HTTP page opened in Incognito mode.

From July it will appear on every HTTP page, whether anyone types or not.

The label sits to the left of the web address, beside a small information icon: the words Not secure, in grey.

Pages served over HTTPS keep their padlock. Nothing changes for them.

What HTTPS actually does

HTTPS encrypts the connection between a visitor's browser and your server, so nobody in between can read or alter what passes along it.

That matters most on public Wi-Fi in a coffee shop, a hotel or an airport.

Without it, the network can see which pages a visitor reads and anything typed into a form, and it can even insert its own content into the page.

It also confirms that the visitor is connected to the site named in the address bar, not to something pretending to be it.

Why it matters without a shop

The usual reaction is that HTTPS is for shops and banks. From July, that stops being true in a way every visitor can see.

• The label appears on every page, the home page included.
• Contact forms collect names, phone numbers and messages.
• Visitors do not know what the label means, only that it sounds bad.
• Competitors on HTTPS will look safer side by side.
• Google already gives HTTPS a slight advantage in search.

The third matters most. Nobody stops to read about encryption; they see the words Not secure in front of your address and draw the obvious conclusion.

What moving involves

Moving a site to HTTPS is not a single switch. It is a short project with several parts.

A certificate goes on the server first. Free certificates are now widely available, and many hosts install and renew them automatically; others charge, or need to be asked.

Every old HTTP address then needs a permanent redirect to its HTTPS version, page by page, so links, bookmarks and search results all land in the right place.

Inside the site, images, scripts and stylesheets still loading from HTTP addresses need changing. A page that mixes the two, known as mixed content, loses its padlock, and scripts loaded that way are blocked.

Outside it, the links need updating too: Search Console, Analytics, AdWords ads, the website link on your Google My Business listing, social profiles and email signatures.

Why February beats June

In February, nobody is rushing. Your web company and your host have time, and so do you.

Finding mixed content takes time on an older site, especially one with years of blog posts and images inserted with full HTTP addresses.

Search engines also need a few weeks to recrawl a site and settle on its new addresses. Moving now means that settling is long finished by July.

And by June, every business that waited will be asking at once. Rushed moves are where redirects get missed and forms quietly stop working.

A worked example

A structural engineering firm of six had a brochure site on plain HTTP: a project gallery, a page for each service, and one contact form.

The partners assumed HTTPS was for online shops. Then one of them tested the contact form and watched Not secure appear in the address bar while typing, as Chrome has done since October.

Their web company scheduled the move for a quiet week. The host installed a free certificate that renews itself, and every HTTP address was redirected to its HTTPS version.

The slow part was mixed content. Older project pages loaded images from full HTTP addresses, and the map on the contact page had been embedded with old code that also used HTTP.

Each page was fixed and checked in a browser. Search Console, Analytics and the firm's Google My Business link were updated the same day.

The move took about a week from start to finish, most of it checking, and July is no longer on anybody's mind.

What to ask your host

Before anything else, put three questions to your host.

Ask whether it can install a certificate that renews itself. An expired certificate produces a full-page warning that is far worse than Not secure.

Ask whether the server supports HTTP/2. Browsers only use it over HTTPS, and it can help pages load faster.

And ask who sets up the redirects. Some hosts offer a setting; elsewhere it is a server configuration change your web company should make and test.

Checking the result

After the move, open each main page in Chrome and look for the padlock, not just on the home page.

Type the old HTTP address of a few inner pages and confirm each lands on its own HTTPS version, not on the home page.

Fill in the contact form yourself and confirm the message reaches the inbox. Forms are where moves most often break without anyone noticing.

Then add the HTTPS version of the site to Search Console as a property, if it is not there already, and watch it for errors over the following weeks.

The counter-case

A site already on HTTPS has nothing to do for July, beyond confirming that every page really loads that way and that the certificate renews itself.

A site due to be rebuilt this spring can fold the move into the rebuild, provided the new site launches on HTTPS well before July.

And the label will not drive away every visitor. Regular customers will still call; the cost falls on strangers choosing between you and a competitor.

But the move only gets harder to schedule as July approaches, and from then on the label will sit on every page of every HTTP site.

This month

1. Check whether your site loads over HTTPS today.
2. Ask your host for a certificate that renews itself.
3. Book the move for a quiet week.
4. Set up redirects from every old HTTP address.
5. Fix mixed content page by page.
6. Update Search Console, Analytics and your listings.
7. Test the forms after the move.

Step four protects everything the site has built up. Without page-by-page redirects, old links, bookmarks and search results lead to errors or to the wrong page.

Asking a host the right questions follows the same approach as Meltdown, Spectre and the server under your site.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.