{"id":14387,"date":"2021-04-16T10:58:14","date_gmt":"2021-04-16T14:58:14","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=14387"},"modified":"2023-03-31T13:14:54","modified_gmt":"2023-03-31T17:14:54","slug":"chrome-https-update-chrome-90-to-use-https-for-incomplete-urls","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/chrome-https-update-chrome-90-to-use-https-for-incomplete-urls\/","title":{"rendered":"Chrome HTTPS Update: Chrome 90 to Use HTTPS for Incomplete URLs"},"content":{"rendered":"\n

Google Chrome version 90 will default to HTTPS for incomplete URLS. For example, Chrome will load \u201chttps:\/\/domain.com\u201d when a user types \u201cdomain.com.\u201d (And if the HTTPS fails because a site lacks SSL\/TLS, it\u2019ll revert to using HTTP.)<\/h2>\n\n\n\n

It\u2019s no secret that using HTTPS to serve up your website is faster and more secure than using the default HTTP protocol. And Google, recognizing that many browser users don\u2019t type in complete URLs when accessing websites, decided to bridge the gap between user experience and security this year. Their latest browser update, version 90, is expected to use HTTPS by default when a user types in a website address without specifying the protocol.<\/p>\n\n\n\n

In reality, this is a logical move considering that the latest data from Google\u2019s Transparency Report<\/a> shows that 95% of sites across Google already use encryption to protect their traffic. But when and why are they implementing this update? Is Chrome forcing HTTPS? And what does this change mean for your website?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

Is Chrome Forcing HTTPS? Not Exactly\u2026<\/h2>\n\n\n\n

In the Chromium Project blog\u2019s March 23 update<\/a>, Google announced many updates that they\u2019ll be rolling out as part of their Chrome 90 update. The one in particular that we\u2019d like to highlight is their shift to making HTTPS the default protocol when loading websites for most users.<\/p>\n\n\n\n

When users manually type in URLs without specifying the scheme (http:\/\/ vs https:\/\/) in Chrome 90, the browser will try to load the site using HTTPS automatically. This means that if someone just types yoursite.com<\/strong> into their browser, Google will load the site as https:\/\/yoursite.com<\/strong> instead of the usual http:\/\/yoursite.com<\/strong> by default. So, instead of trying to connect first using the insecure HTTP protocol, it will make the secure HTTPS protocol the go-to instead.<\/p>\n\n\n\n

Historically, Google (and other browsers) would initially try to load all web pages using HTTP by default because it was the most widely used scheme for years. In recent years, this would result in the ugly \u201cNot Secure\u201d warnings displaying on your site \u2014 which likely drove away some potential customers for many businesses.<\/p>\n\n\n\n

\"\"
A screenshot of an insecure website and the “Not Secure” warning it displays.<\/figcaption><\/figure>\n\n\n\n

But now that HTTPS is the heavyweight champion on virtually all major platforms, they\u2019re now making the official switch to the secure protocol by default for all incomplete user queries rather than using it as a redirect.<\/p>\n\n\n\n

Of course, there are a few specific exceptions that Google won\u2019t<\/em> use HTTPS for automatically \u2014 and we\u2019ll address those items in a minute. But first, let\u2019s talk about the advantages of Chrome using HTTPS by default.<\/p>\n\n\n\n

Why This Move to HTTPS as a Default Matters<\/h2>\n\n\n\n

Google\u2019s move to using HTTPS as the default method for loading websites is good because it assumes that most sites are using SSL\/TLS (which they are). Will this have a big or negative impact for loading sites that aren\u2019t using SSL\/TLS certificates? Nope. Those sites will still load \u2014 it\u2019s just that the browser is going to try loading them using HTTPS first. Then, when that fails, it\u2019ll fall back to using HTTP to load the site.<\/p>\n\n\n\n

I think Google\u2019s likely doing this for a few key reasons:<\/p>\n\n\n\n

    \n
  1. They assume that Chrome users want to keep their data secure.<\/strong> Regardless of whether users bother to type \u201cHTTPS\u201d as part of the web address, Google assumes that they want to use keep their data secure using encryption. (That would be a good assumption on Google\u2019s part considering that insecure connections can result in costly data breaches<\/a>.)<\/li>\n\n\n\n
  2. Google says security is one of their top priorities.<\/strong> According to their Transparency Report, \u201cWe believe that strong encryption is fundamental to the safety and security of all users of the web. Thus, we\u2019re working to support encryption in all of our products and services.\u201d<\/li>\n\n\n\n
  3. 95% of web traffic already uses HTTPS.<\/strong> Considering that the overwhelming majority of web traffic relies on HTTPS, connecting to HTTPS first just makes sense. It\u2019s faster to try to connect with the protocol that\u2019s most likely to succeed rather than trying HTTP first and waiting for the server to redirect to HTTPS afterward.<\/li>\n<\/ol>\n\n\n\n

    This move by the tech giant is a positive one that benefits everyone except the cybercriminals who want to exploit us.  <\/p>\n\n\n<\/span><\/span>\n\n\n

    Defaulting to HTTPS Automatically Improves Site Security and User Data Privacy<\/h3>\n\n\n\n

    Cybercriminals use man-in-the-middle attacks<\/a> to intercept data while it\u2019s in transit between users\u2019 browsers and your web server. When data transmits via HTTP, it\u2019s moving in plaintext format that bad guys can intercept, read, modify or steal. Depending on the types of data they get their hands on, bad guys can use this information to carry out identity theft, financial fraud, or a variety of other cybercrimes.<\/p>\n\n\n\n

    But when you use HTTPS, you\u2019re protecting that data using encryption so that no one but your intended party can access the readable information. You\u2019re also asserting your organizational identity as well at the beginning of the connection so that users\u2019 clients know that they\u2019re connecting to your legitimate site. Here\u2019s a quick look at what HTTPS does:<\/p>\n\n\n\n

    \"\"
    A basic illustration showcases what HTTPS does in terms of encryption and authentication.<\/figcaption><\/figure>\n\n\n\n

    We\u2019re not going to get into all of the details about HTTPS here. (That\u2019s another big topic!) If you want to read more about how HTTPS works<\/a> from a technical perspective, check out my colleague\u2019s blog that really dives in on the topic.<\/p>\n\n\n\n

    Connecting via HTTPS Automatically Improves Site Load Speeds<\/h3>\n\n\n\n

    By opting to load websites first using the secure scheme right off the bat, Chrome eliminates an unnecessary step for HTTPS-enabled websites \u2014 waiting for the server to redirect from HTTP to HTTPS. Using HTTPS to load HTTPS-enabled sites results in faster initial load speeds, which makes for a better user experience.<\/p>\n\n\n\n

    Now, what does this mean for websites that don\u2019t yet support HTTPS? The browser will try to load the website using HTTPS by default. But when that doesn\u2019t work, it will redirect back to HTTP. This process will kick in regardless of why HTTPS connection failed \u2014 no SSL\/TLS certificate installed on your website, server misconfigurations, or other issues throwing up SSL certificate errors.<\/p>\n\n\n\n

    Of Course, There Are Exceptions to the Rule\u2026<\/h2>\n\n\n\n

    It\u2019s important to note that Google isn\u2019t implementing this HTTPS-by-default move unilaterally; they\u2019ll do it in most but not all cases. In some situations, the browser will still default to use HTTP when loading specific items:<\/p>\n\n\n\n