Chrome 68 Is Here — Every HTTP Page Now Says "Not Secure

As of last Tuesday, July 24th, the world's most-used browser tells your visitors not to trust you — if you're still on HTTP. Chrome 68 shipped with the change Google announced back in February: every page served over plain HTTP now carries a "Not Secure" label in the address bar. Not just checkout pages, not just login forms — your homepage, your blog, your brochure site. All of it.

There's no judgment call in the label, no assessment of what your site does. HTTP means "Not Secure," full stop. If you've been putting off the HTTPS migration, this is the week the cost of waiting became visible to every Chrome user who lands on your site.

The endgame of an eighteen-month rollout

Google telegraphed this move at every step, tightening the screw one release at a time:

• January 2017 — Chrome 56: HTTP pages with password or credit card fields get "Not Secure."
• October 2017 — Chrome 62: the label extends to any HTTP page with a form field the moment you type in it, and to all HTTP pages in Incognito mode.
• July 2018 — Chrome 68: every HTTP page, unconditionally.

And it's not over. Google has already said that in an upcoming release the "Not Secure" text will flash red when users enter data on HTTP pages, and that the plan is eventually to remove the positive "Secure" wording from HTTPS pages entirely — because encryption is meant to become the unremarkable default, with only its absence called out.

The context makes the timing rational rather than punitive: by Google's transparency numbers, HTTPS now carries the substantial majority of Chrome traffic, and most of the top sites on the web default to it. Certificates are free, setup is largely automated, and HTTPS has been a (lightweight) search-ranking signal since 2014. The excuses have run out — which is exactly the argument Google is making with the label.

The migration checklist

The good news: a well-planned HTTPS migration is a solved problem. Here's the sequence that avoids the common potholes.

1. Get a certificate — free is fine

For the overwhelming majority of sites, a free domain-validated certificate from Let's Encrypt is exactly the right choice — the encryption is identical to what paid certificates provide. Better still, many hosts and CDNs now provision certificates for you with a checkbox. If you're on your own server, an ACME client like Certbot issues and renews automatically:

certbot --nginx -d example.com -d www.example.com

Note the renewal implication: Let's Encrypt certificates last 90 days by design. Automation handles it — but verify the automation (more on that below).

2. Redirect everything with 301s — permanently

Every HTTP URL should answer with a 301 permanent redirect to its exact HTTPS twin — not just the homepage, but every path, preserving the full URL so deep links and accumulated search equity carry over:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Or with Apache:

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

Use 301 (permanent), not 302 — search engines treat 301 as "the new address is the real one" and transfer ranking signals accordingly.

3. Sweep for mixed content

The classic migration wound: the page loads over HTTPS, but an image, script or stylesheet still points at http:// — and the padlock breaks anyway (browsers block insecure scripts outright). The fixes, in order of preference:

• Use relative URLs (/img/logo.png) or protocol-relative references so assets inherit the page's scheme.
• Search your templates and database for hardcoded http:// references — in a CMS, old post content is the usual culprit.
• Let CSP report the stragglers: the Content-Security-Policy-Report-Only header with a report URI surfaces mixed content across the whole site without breaking anything while you hunt.

4. HSTS — once you're confident

The Strict-Transport-Security header tells browsers to skip HTTP entirely for your domain, eliminating even the first insecure request. It's the right end state — but it's a commitment, because browsers will enforce it for the duration you declare. Start with a short max-age, confirm nothing's broken, then extend:

# start conservative, raise to a year (31536000) once stable
add_header Strict-Transport-Security "max-age=300" always;

Hold off on preload until you're certain — getting your domain out of browsers' preload lists is slow and manual.

5. Re-verify with search engines

Google Search Console treats https://example.com as a different property from http://example.com — add and verify the HTTPS property, submit your sitemap with HTTPS URLs, and update the property in Analytics too. Expect some ranking wobble for a few weeks as the index digests the move; the 301s ensure it settles.

6. Update the stragglers

CDN origin settings, canonical tags, Open Graph URLs, email templates, social profiles, paid ad destination URLs. Anything still generating HTTP links is generating a redirect hop at best.

You've traded one risk for another — watch it

Here's the part most migration guides skip: the day you finish, you acquire a brand-new failure mode. An HTTP site can't have an expired certificate; an HTTPS site with an expired certificate greets every visitor with a full-page browser warning — functionally a total outage, and one that Chrome's new posture makes more alarming than ever. Renewal automation fails quietly: the cron job stops, a DNS change breaks validation, the renewed cert never reaches one server behind the load balancer. And the industry is simultaneously pushing certificate lifetimes shorter, so renewals only get more frequent from here.

The answer is independent verification — an external check that reads the certificate your servers actually serve and alerts you weeks before expiry, no matter what your automation believes.

Make the label work for you

Chrome 68 turned HTTPS from best practice into table stakes: the browser now actively tells visitors which sites didn't bother. The migration takes a weekend for a typical site, the certificate is free, and every step above is well-trodden. What remains afterward is simply keeping it healthy.

CompleteStatus covers that last mile — certificate expiry monitoring with alerts at 30, 14 and 7 days, plus uptime checks that catch TLS failures the moment a visitor would. Create a free account, migrate this month, and let "Not Secure" be something your competitors' visitors see.