![\"warning](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/01\/Insecure-Login-Pages.png\")
<\/p>\nThis week, Google Chrome 56 and Mozilla Firefox 51 were both released. These updates bring a new warning about insecure login pages, which appear prominently in the address bar.<\/p>\n
This is part of the industry-wide campaign to move away from HTTP, which is insecure, and leaves users’ online activity vulnerable to snooping, interception, modification, and much more.<\/p>\n
Chrome 56 will show this warning for any password\/credit card field loaded over HTTP.<\/p>\n
<\/p>\n
This includes forms that post to HTTPS if the page itself is HTTP. Both the page itself, as well as\u00a0the fields, need to be delivered over HTTPS to be properly secure and receive the \u201cSecure\u201d message and green padlock treatment. To help spread the word, Google has been sending messages via Search Console<\/a> to warn admins if any unsecure fields are found on their websites.<\/p>\n In Firefox 51 the warning will be more subtle. The page will receive a\u00a0\u201cbroken padlock\u201d icon, which shows the padlock with a red strike through it. If you click the padlock, a message will tell users that their login information is at risk.<\/p>\n In Firefox 51 there will not be any warning for credit card fields, though Mozilla developers have previously said this feature is coming. Unfortunately, the ability to actively detect\u00a0those fields has caused it to be delayed.<\/p>\n Chrome 56 for Android will also warn about password\/credit card fields served over\u00a0HTTP, however to accommodate for the smaller UI, only the \u201c(i)\u201d symbol will be shown in the address bar. Clicking the (i) will display additional text. The same behavior will also come to a future version of iOS, though when the update will be made has yet to be determined.<\/p>\n In-form warnings are coming to future versions for both browsers. These are warnings which will appear directly below the fields on the page. This will bring further attention to insecure fields and make it easier for users to see the warnings. Both mobile platforms will also get in-form warnings in future releases<\/a>.<\/p>\n For any sites out there still using HTTP, make sure a migration to HTTPS is in your immediate plans. The encrypted web is coming<\/a>, and the warnings are only going to get more severe<\/strong>. In fact, a Google engineer recently wrote<\/a> \u201ceventually, Chrome will show a Not Secure warning for all pages served over HTTP, regardless of whether or not the page contains sensitive input fields. Even if you adopt one of the more targeted resolutions above, you should plan to migrate your site to use HTTPS for all pages.\u201d<\/p>\n\n\n![\"warning](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/01\/Insecure-Login-Pages-2.png\")
<\/p>\n