'Not Secure,' Says Chrome, Right Next to Your Login Form

Chrome 56 shipped on January 25, and with it the warning label era began. Any page served over plain HTTP that collects a password or a credit card number now carries the words ‘Not Secure’ in the address bar. In plain language, directly beside your organization’s name.

Google announced this in September with its usual courtesy interval, and the announcement was explicit about the path. This is the first step. The labeling will expand, eventually to all HTTP pages, with the wording growing in prominence and eventually in color. The destination is a web where unencrypted pages are marked the way unpasteurized milk is.

Anyone following along has known the direction since the 2014 ranking-signal announcement made encryption an SEO conversation, and our advice then was to treat the ranking nudge as the smallest of the reasons. The label is the larger reason arriving on schedule. Not a penalty buried in an algorithm, but a sentence your visitors read at the exact moment they decide whether to type their password into your page.

The objections, aged out from under their objectors

The case against migrating was never strong, but in 2014 it had line items. Watch what happened to each.

‘Certificates cost money and expire embarrassingly.’ Let’s Encrypt now issues free, automated, auto-renewing certificates at a scale measured in tens of millions. Hosts and CDNs have folded provisioning into a checkbox. The certificate line item has gone from budget to rounding error.

‘Encryption slows the site down.’ HTTP/2, supported by every current browser and requiring TLS in practice, makes the encrypted stack the faster stack for most sites, per our protocol coverage when HTTP/2 was standardized. The performance argument now runs in encryption’s favor. Our own migration numbers confirm it routinely.

‘Mixed-content cleanup is a slog.’ True in 2014 for sites with a decade of hard-coded asset URLs. Less true every year since, as CMS tooling, protocol-relative habits, and content-fixing scripts matured. It is now a scoped project, not an expedition.

What remains of the case for HTTP is inertia, and inertia now has a warning label attached to it, displayed to every Chrome visitor at their moment of maximum attention.

The checklist, abbreviated because the ground is well-trodden

• Certificates everywhere, automated. Every domain, subdomain, and forgotten microsite in the site inventory, per the standing inventory habit. Renewal automated, so the expired-certificate outage joins the retired failure modes.

• Redirect map, one hop. HTTP to HTTPS, site-wide, 301s. Canonical tags, sitemap URLs, and internal links updated to the encrypted versions so the crawl consolidates cleanly, per the 2014 migration guide this abbreviates.

• Mixed-content sweep. Crawl for insecure asset references before launch. Fix at the template layer where possible. Watch the console during the verification pass. One HTTP image demotes the padlock and, on form pages, invites the label back.

• Search Console re-verification and annotation. The HTTPS property verified, the change annotated in analytics, and the traffic watched through the transition window with the calm the annotation buys.

• HSTS once stable. After a clean interval, the header that tells browsers to skip HTTP entirely, which closes the downgrade window and finishes the job properly.

The moment-of-decision math

For the stakeholders who need the business case in one image, here it is, drawn from the sites we serve.

Picture the donation form during year-end giving. The application login during admissions season. The patient portal, the event registration, the checkout. The pages where a first-time visitor, half-decided, sizes up whether your institution is the kind that handles things properly. Now add the words ‘Not Secure’ beside your name at precisely that moment, courtesy of the browser more of your visitors use than any other.

No competing line item in this quarter’s budget costs so little and defends so much. The migration is measured in days for most sites. The label’s cost is measured in every hesitation it introduces at the highest-intent moments your site has. And the asymmetry only grows as Chrome’s labeling expands on the published schedule.

Trust, as our design team keeps demonstrating in testing sessions, is mostly the accumulation of small competence signals, and it is spent in the same denominations. This label spends it for you, continuously, until the migration ships.

Field notes from three years of these migrations

Since the checklist above compresses a category we have now run dozens of times, the gotchas that actually bite, in frequency order.

The forgotten-subdomain surprise. The site inventory misses the events site or the legacy application portal, which then greets visitors with a certificate error more alarming than the label the project set out to remove. Run the census first, always.

The hard-coded HTTP reference in content. Templates migrate cleanly while a decade of editor-pasted image URLs does not. That is why the database-level rewrite belongs in the plan rather than the punch list.

The third-party embed that refuses encryption. The ancient map widget or vendor form served HTTP-only, which either gets upgraded, replaced, or becomes the one mixed-content warning that undoes the padlock. Inventory these early and send the vendor letters with deadlines.

And the redirect chain buildup. The new HTTPS redirect stacked on top of old www-normalization and vanity-URL rules, until every request hops three times. Audit the chain to one hop while you are in there, and pocket the latency.

None of these is difficult. All of them are why ‘the migration is measured in days’ assumes the census came first. Which it should have anyway.

The pattern noted

File the strategy note alongside the to-do list, because it completes a pattern we have tracked across three years. Google moved encryption from incentive, the 2014 ranking signal, to default expectation, the label. Exactly the way it moved mobile-friendliness. The placement-for-adoption file predicted the mechanism, if not the date.

The browser address bar has joined the results page as a tool for steering the web’s technical baseline. The way to read it is unchanged. When the platforms signal a direction this clearly, with this much runway, the organizations that move early convert a compliance scramble into a scheduled Tuesday.

Sites that migrated between 2014 and 2016 experienced January 25 as a news item about other people’s address bars. For the sites still holding out: the checklist above, this quarter, before the label wording escalates and before your busiest season puts maximum eyes on it. The era of HTTP as a defensible default ended this week. It published its own obituary in the address bar.