Chrome HTTPS-Only Mode: Enable “Always Use Secure Connections” (HTTPS-First) the Right Way

What HTTPS-Only Mode is (and why it matters) .

Chrome calls this “Always use secure connections.” You’ll also see it described as HTTPS-Only Mode or HTTPS-First Mode.

HTTPS-Only Mode is a browser-level safety net. When it’s enabled, Chrome tries to load a site over HTTPS (encrypted) first — even if you typed http://, clicked an old bookmark, or followed a link that still points to HTTP. If the site supports HTTPS, the upgrade is seamless: you get encryption without thinking about it.

The big win is what it prevents: silent downgrade behavior. Without HTTPS-Only Mode, a site that supports HTTPS can still be loaded over HTTP if you land on a legacy link or if a network attacker forces a downgrade in a few common ways. HTTPS-Only pushes Chrome toward the secure option first and makes insecure fallbacks noisy with a warning step. That’s exactly what you want on public Wi-Fi or any network you don’t fully control.

It’s also a practical setting for 2026 because most of the web is already HTTPS. The remaining HTTP holdouts are often old intranet tools, local device admin pages, or very small sites that haven’t modernized. HTTPS-Only Mode helps you default to safer browsing while keeping a clear escape hatch when you truly need HTTP.

Related: If you’re building a full privacy baseline, start with the hub: Chrome Privacy Settings.

Key terms (quick definitions) .

• HTTP: Unencrypted web traffic. Someone on the network can potentially read or modify it.
• HTTPS: Encrypted web traffic using TLS. Protects against casual snooping and many tampering attacks.
• TLS: The encryption protocol behind HTTPS. If you want the deeper layer, see Chrome TLS Settings.
• Downgrade attack: When an attacker forces a connection from HTTPS back to HTTP to remove encryption.
• Mixed content: An HTTPS page that loads some resources over HTTP (images/scripts). This can trigger warnings or break features.
• HSTS: A policy some sites send that tells browsers “always use HTTPS.” HTTPS-Only Mode is similar, but controlled by you instead of the site.

Before you start (fast checks) .

Enabling HTTPS-Only Mode is simple — the time sink is usually troubleshooting a site that doesn’t support HTTPS, or a work network that routes traffic in unusual ways. These fast checks prevent wasted effort.

• Update Chrome first: Go to Get or Update Chrome. Security settings and warnings can change across versions.
• Know what kind of site you’re opening: Public website, private intranet, or local device page (like a router at 192.168.x.x)?
• Check if the site already supports HTTPS: Type the domain with https:// manually once. If it loads cleanly, HTTPS-Only Mode will likely be painless.
• Consider Secure DNS: HTTPS protects data after you connect, but DNS can still leak where you’re going. Pair this guide with DNS-over-HTTPS or Secure DNS setup.
• If you’re on public Wi-Fi: Use Public Wi-Fi security tips as your baseline. HTTPS-Only Mode is one part of that story.

Related: For a complete connection hardening stack, also see Chrome Secure Connection Settings.

Step-by-step: enable HTTPS-Only Mode .

Chrome’s UI wording is typically Always use secure connections. This is the same concept people refer to as HTTPS-Only Mode or HTTPS-First Mode. The goal is: try HTTPS first, warn before falling back.

Desktop (Windows / macOS / Linux / ChromeOS) .

1. 1 Open Chrome Settings (three dots menu → Settings).
2. 2 Go to Privacy and security → Security.
3. 3 Enable Always use secure connections (HTTPS-Only / HTTPS-First).
4. 4 Test it: open a site you know supports HTTPS and confirm the address starts with https://.
5. 5 If a warning appears for a specific site, choose the safest option: Go back unless you explicitly trust the site and need HTTP for a specific reason.

What “success” looks like: Old HTTP links transparently upgrade to HTTPS. If a site truly doesn’t support HTTPS, Chrome shows a warning instead of quietly loading it insecurely.

Android (Chrome on phones/tablets) .

On Android, the setting is also typically called Always use secure connections. The path can vary slightly by version, but it lives under the Security area.

1. 1 Open Chrome → tap the ⋮ menu → Settings.
2. 2 Tap Privacy and security (or sometimes just Privacy).
3. 3 Tap Security.
4. 4 Enable Always use secure connections.
5. 5 Test: open a website and confirm it upgrades to https://.

iPhone / iPad (Chrome on iOS) .

Chrome on iOS runs on Apple’s WebKit engine under the hood, and security settings are more constrained than desktop Chrome. You can still enforce safer browsing behavior via Chrome’s privacy and security settings where available, but some controls may be narrower depending on iOS version.

1. 1 Open Chrome → tap ⋯ → Settings.
2. 2 Look for Privacy and/or Security options (varies by version).
3. 3 If you see Always use secure connections (or equivalent), enable it.
4. 4 If you do not see it, use the “best-effort” approach: prefer HTTPS links, avoid HTTP on public Wi-Fi, and consider a VPN for hostile networks.

Related: If you’re doing this for privacy reasons, the most impactful companions are DNS privacy and tracking protection.

Common variations (what you’ll see) .

• Label differences: “Always use secure connections” / “HTTPS-First Mode” / “HTTPS-Only Mode” (same idea).
• Warning scope differences: Some builds warn primarily for public sites and may treat local network addresses differently.
• Incognito behavior: Chrome may be stricter in Incognito or on higher-protection profiles.

Advanced: strict behavior, exceptions, and enterprise notes .

HTTPS-Only Mode is powerful because it changes the default. But advanced users (and especially businesses) need to think about exceptions, local resources, and policy control. The goal is not “break everything until it’s secure” — the goal is “make insecure browsing a deliberate choice.”

Related: In managed environments, see Secure configuration (enterprise best practices) and the hub: Chrome Enterprise Guide.

How Chrome behaves when a site doesn’t support HTTPS .

With HTTPS-Only Mode enabled, Chrome attempts an HTTPS connection first. If the site genuinely has no HTTPS support, Chrome shows a warning (instead of silently loading HTTP). This warning is the point: it stops you from accidentally typing a password, entering card details, or logging into anything on an unencrypted page.

Safe exceptions (when HTTP is still normal) .

There are legitimate cases where HTTP still exists, especially on private networks: routers, printers, NAS dashboards, lab devices, local dev servers, and legacy intranet apps. The risk isn’t “HTTP is always evil” — it’s that HTTP on an untrusted network is easy to snoop on and easy to tamper with.

• Local device admin pages: http://192.168.0.1, http://router.local, printer dashboards.
• Lab/intranet tools: Old internal apps that never got certificates.
• Development: Localhost testing. (Better practice is local HTTPS or a dev proxy.)

If you absolutely must access HTTP on a local network, do it intentionally: use a trusted network, avoid logging in with sensitive credentials, and consider moving that device/app to HTTPS if possible. If you manage the environment, HTTPS-Only Mode is also a signal: it tells you which internal systems are overdue for modernization.

Pair HTTPS-Only with Secure DNS (DoH) for “full path” privacy .

HTTPS encrypts the content of the connection, but your network can still learn a lot via DNS lookups (which domain you’re visiting). That’s why the best “high trust” configuration is: HTTPS-Only Mode + Secure DNS. Together they reduce both content snooping and many forms of network manipulation.

• Secure DNS: Chrome Secure DNS setup
• DoH settings details: DNS-over-HTTPS settings
• Threat model guide: DNS privacy guide

Enterprise control: policy, compliance, and rollout strategy .

For businesses, HTTPS-Only Mode is less about “one user” and more about standardizing risk. When everyone’s browser behaves predictably, your support team can troubleshoot faster and your compliance posture improves.

A practical rollout strategy looks like this:

• Phase 1 (audit): Enable it for IT / security team first and track what breaks (intranet tools, old vendor portals).
• Phase 2 (pilot): Roll to a small group from each department. Document allowed exceptions.
• Phase 3 (standardize): Roll org-wide, pairing it with Security Checkup guidance and secure DNS defaults.
• Phase 4 (enforce): Use Chrome Enterprise policies where appropriate and remove “tribal knowledge” exceptions over time by upgrading internal systems to HTTPS.

Related (enterprise): Enterprise security settings, Zero trust security guide, Enterprise privacy compliance.

Common alternatives users compare .

• HTTPS-Only Mode vs VPN: HTTPS protects the web session; a VPN also hides traffic from local networks and can help on hostile Wi-Fi. See Best VPN for Chrome.
• HTTPS-Only Mode vs Secure DNS: HTTPS encrypts content; Secure DNS reduces DNS leakage and manipulation. Use both: Private DNS vs Secure DNS.
• HTTPS-Only Mode vs “Safe Browsing”: Safe Browsing focuses on malicious sites/downloads; HTTPS-Only focuses on transport security. Combine with Safe Browsing settings.
• HTTPS-Only Mode vs extensions (HTTPS Everywhere): Browser-native HTTPS-Only is simpler and more consistent; extensions can add complexity and permissions risk. Learn more in Privacy extensions guide.

Privacy & security notes (threat model) .

HTTPS-Only Mode is about one thing: reducing the risk of insecure transport. When you browse over HTTP, your traffic is not encrypted. That means someone on the same network (or any intermediary between you and the site) can potentially: read what you send, inject content, redirect you, or modify downloads.

Related: If you suspect infection, suspicious redirects, or fake warnings, start here: Remove Malware from Chrome.

What HTTPS-Only Mode does NOT do .

• It does not make a website trustworthy: HTTPS encrypts the connection, but the site can still be a scam.
• It does not block tracking cookies by itself: Use third-party cookie controls and tracking protection.
• It does not replace Safe Browsing: Keep Safe Browsing set appropriately.
• It does not hide your IP address: For that, you’d need a network privacy tool like a VPN (depending on your goals).

Recommended baseline settings .

• Option A (balanced): Enable HTTPS-Only Mode + use Secure DNS (with your current provider or a trusted one).
• Option B (maximum privacy): HTTPS-Only + Secure DNS + stricter cookie controls + reduce permission prompts. Start with Privacy Best Practices.
• Option C (compatibility): Enable HTTPS-Only but allow HTTP only when you deliberately need it for local devices/intranet.

Recommended settings by goal .

Troubleshooting .

Related: If a site is failing because of connection/privacy layers, also check: Secure connection settings and DNS-over-HTTPS.

If you see a warning for a site you need .

First, decide what kind of site it is. If it’s a login, payment, or anything that handles sensitive data, do not continue over HTTP. Instead:

• Try the HTTPS version explicitly: type https://example.com.
• Try a different browser profile (in case extensions are interfering): see Profile security settings.
• If it’s a company site, ask IT whether the service has an HTTPS endpoint or a modern URL.

If a local device page (router/printer) stops loading .

This is common. Many local device dashboards still ship as HTTP-only by default. If you trust the device and you’re on your home/office network:

• Confirm you’re on the right network (not a guest Wi-Fi).
• Use the device’s HTTPS option if available (many modern routers have it).
• If HTTPS truly doesn’t exist, access it intentionally over HTTP — and avoid reusing high-value passwords.

If Chrome upgrades to HTTPS but the page is broken or “partially loaded” .

That’s usually mixed content (an HTTPS page trying to load some HTTP resources), or a server misconfiguration. You can:

• Reload once and confirm the site isn’t stuck on a cached redirect.
• Try Incognito to rule out extension interference.
• Check whether your Secure DNS provider is blocked on the network (some corporate networks do this).
• If it’s your own site, fix mixed content links and ensure correct TLS configuration. See TLS guide for context.

If HTTPS-Only Mode “keeps turning itself on” .

Some security profiles and protection tiers can enable stricter HTTPS behavior automatically (especially in higher protection modes). If you’re on a managed device, an enterprise policy may enforce it. If you want to understand that management layer, see: Managed browser security and IT admin security settings.

If you need to reset safely (without nuking everything) .

Don’t jump straight to a full reset unless you have strong reasons. Try “safe minimal” troubleshooting first:

• Disable one suspicious extension at a time (start with any that modify network traffic). See Extension security check.
• Clear site data for the specific website instead of wiping all history: Clear browsing data.
• If Chrome behaves strangely across many sites, run Chrome Security Checkup.

Sources & further reading .

• Google Chrome Help (Android): “Always use secure connections”
• Google Security Blog: HTTPS by default (timeline and rollout details)
• Chromium Blog: Towards HTTPS by default

Disclosure: Some pages may mention tools or services. Recommendations are editorial and based on testing.