This change isn\u2019t because Google no longer thinks HTTPS is important, though \u2014 in fact, it\u2019s the opposite. Google expects every website to have HTTPS by default<\/em>.<\/p>\n\n\n\n Why is Google removing this well-known security lock symbol? And what does this padlock icon change mean for your organization, website security, and the cyber security industry as a whole?<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n As the world\u2019s most popular web browser<\/a>, Google Chrome is \u201cmov[ing] towards a web that is secure-by-default.\u201d<\/p>\n\n\n\n This means that HTTPS (i.e., the hypertext transfer protocol secure) should be considered the default security baseline for all websites. Historically, the padlock icon represented this concept in web browsers. The problem? The icon has consistently been misconstrued by users as representing a safe<\/em> website rather than a secure<\/em> one. (No, those terms aren\u2019t synonymous; we\u2019ll speak more about that later.)<\/p>\n\n\n\n This is why the Google Chrome Security Team announced in a May 2023 Chromium blog post its departure from the traditional padlock icon \u2014 a lock icon that\u2019s been associated with website security for the last 40 or so years. The change will take effect with Chrome version 117 (estimated to be released in September).<\/p>\n\n\n\n The padlock will be phased out for both computer and mobile users:<\/p>\n\n\n\n Websites that use HTTP will continue to be flagged as \u201cNot Secure\u201d by Google Chrome. Google expects that all websites should have HTTPS. You might say that HTTPS is the \u201cbare minimum\u201d expected. No HTTPS? Your users will be warned that your website is \u201cNot Secure.\u201d<\/p>\n\n\n\n So, what will Chrome display instead of the padlock icon?<\/strong> See for yourself:<\/p>\n\n\n\n \u2026 Okay. Interesting. Here\u2019s what it\u2019ll look like in the browser\u2019s address bar when Chrome 117 launches in the fall:<\/p>\n\n\n\n Hmm. It\u2019s not much to write home about, as the saying goes. But why is Google bothering to go through the trouble of replacing a symbol that\u2019s been around for 30+ years?<\/p>\n\n\n\n The Google Chrome Security Team says the move is based (in part) on the results of its browser UI security study, which showed that the overwhelming majority of users don\u2019t \u201cget\u201d what the lock icon represents. Google\u2019s online study<\/a> of 1,880 users showed that 89% of respondents misconstrued the padlock\u2019s meaning. According to the Chromium update:<\/p>\n\n\n\n \u201cReplacing the lock icon with a neutral indicator prevents the misunderstanding that the lock icon is associated with the trustworthiness of a page, and emphasizes that security should be the default state in Chrome.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n Fair enough, particularly when you consider that 82.6% of websites use HTTPS as the default protocol<\/a>. This means that four in five websites have SSL\/TLS certificates installed \u2014 the majority of which use only the lowest level of identity verification (i.e., domain validation).<\/p>\n\n\n\n While this new icon is generic and leaves something to be desired visually, we understand where Google is coming from because many users don\u2019t recognize the crucial difference between a safe and secure website. From a security standpoint, this is a crucial delineation we often talk about here at Hashed Out.<\/p>\n\n\n\n In the old world, HTTP wasn’t the default. HTTPS was special, and so it was rewarded with the padlock icon. In the new world, every website is expected to have HTTPS. It\u2019s just “table stakes.\u201d As the Chrome team says:<\/p>\n\n\n\n \u201cWhen HTTPS was rare, the lock icon drew attention to the additional protections provided by HTTPS. Today, this is no longer true, and HTTPS is the norm, not the exception, and we’ve been evolving Chrome accordingly. [\u2026] We\u2019re excited that HTTPS adoption has grown so much over the years, and that we\u2019re finally able to safely take this step, and continue to move towards a web that is secure-by-default.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n<\/span><\/span>\n\n\n The Chrome Security Team\u2019s announcement assures that the browser will continue identifying insecure websites by slapping \u201cinsecure\u201d labels on them. But when you consider that virtually anyone can get their hands on a domain validation (DV) SSL\/TLS certificate<\/a>, simplifying informing that a website uses HTTPS on its own doesn\u2019t mean much. There needs to be something extra to provide another layer of security and verification to prove a website is secure, safe<\/em>, and trustworthy<\/em>.<\/p>\n\n\n\n This is why it\u2019s going to be more important than ever to assert your digital identity on your website using organization validation (OV)<\/a> or extended validation (EV) SSL\/TLS certificates<\/a>. Companies increasingly find themselves combatting phishing scams, email spoofing<\/a>, and other fraud-related issues. Knowing this, as the industry progresses toward HTTPS as the default, it\u2019s imperative that companies use trustworthy digital certificates that bring verifiable digital identity to the table. <\/p>\n","protected":false},"excerpt":{"rendered":" Farewell, lock symbol: Google Chrome will retire the padlock icon as the next step in making HTTPS the default for all websites. Billions of people around the world associate a…<\/p>\n","protected":false},"author":17,"featured_media":16805,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[13107,17,10200],"tags":[13232,181],"class_list":["post-16799","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-beyond-hashed-out","category-industry-lowdown","category-monthly-digest","tag-padlock-icon","tag-security-indicators","post-with-tags"],"views":21228,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/05\/google-chrome-replaces-padlock-icon-feature-v2.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/16799","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=16799"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/16799\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/16805"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=16799"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=16799"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=16799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What\u2019s Happening? Chrome to Put the Padlock Icon in the Rearview Mirror<\/h2>\n\n\n\n
\n
What the Padlock Icon Will Become in Chrome 117<\/h2>\n\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/05\/tune-to-replace-padlock-icon-google-chrome.png\"){kind=icon}
![\"An](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/05\/google-chrome-replaces-padlock-icon-feature-776x1024.png\"){kind=icon}
Why Change the Padlock Icon? To Continue Moving Toward HTTPS Security as the Default<\/h2>\n\n\n\n
\n
Users Need to Know the Difference: Safe \u2260 Secure<\/h3>\n\n\n\n
\n
Bottom Line: HTTPS Is the \u201cNorm\u201d For All Websites<\/h2>\n\n\n\n
\n
Final Thoughts: Strong Website Security Needs Verifiable Identity (Not a Lock Icon)<\/h2>\n\n\n\n