Security News > 2021 > March > Google Chrome will use HTTPS as default navigation protocol

Google Chrome will switch to choosing HTTPS as the default protocol for all URLs typed in the address bar, starting with the web browser's next stable version.
This move is part of a larger effort to defend users from attackers attempting to intercept their unencrypted web traffic and speed up the loading of websites served over HTTPS. "Chrome will now default to HTTPS for most typed navigations that don't specify a protocol," Chrome team's Shweta Panditrao and Mustafa Emre Acer said.
"For sites that don't yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails."
To do that, you will have to go to chrome://flags/#omnibox-default-typed-navigations-to-https and enable HTTPS as the default navigation protocol.
You also have the option to choose a 3 or 10-second timeout to give the browser enough time to determine the availability of the HTTPS URL. If Chrome cannot find an HTTPS version for the website you entered in the address bar, it will automatically fall back to the HTTP URL. "For sites that don't yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails," they said.
"Chrome is invested in ensuring that HTTPS is the default protocol for the web, and this change is one more step towards ensuring Chrome always uses secure connections by default."
News URL
Related news
- Fake Google Chrome Sites Distribute ValleyRAT Malware via DLL Hijacking (source)
- Google Chrome's AI-powered security feature rolls out to everyone (source)
- Google Chrome disables uBlock Origin for some in Manifest v3 rollout (source)
- Google Cuts Off uBlock Origin on Chrome as Firefox Stands Firm on Ad Blockers (source)
- Google fixes Chrome zero-day exploited in espionage campaign (source)
- Google fixes exploited Chrome sandbox bypass zero-day (CVE-2025-2783) (source)
- Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks (source)
- Phishing-as-a-service operation uses DNS-over-HTTPS for evasion (source)