Is it safe to open an http:// link?

Is it safe to open an http:// link?

Opening an http:// link to read a page is a low risk for most people, but nothing on that page is private. Anyone on the network path between you and the server can read the page and change it before it reaches you. The risk becomes real when you type something into the page, such as a password, or when you download a file from it.

The "Not secure" label in Chrome describes the connection. It does not judge the site. A plain http site can be honest, and an https site can be a scam. HTTPS protects the trip between you and the server. It says nothing about the person who runs the server.

What http:// means on the wire

HTTP (hypertext transfer protocol) is the set of rules a browser and a web server use to ask for pages and send them. With http://, that conversation travels as plain text. HTTPS is the same protocol inside TLS (transport layer security). TLS encrypts the traffic, and it checks that the server holds a valid certificate for the name in the address bar. For what a request and a response actually contain, read what HTTP is and how a request works.

The "network path" is every device your traffic passes through. That includes the Wi-Fi access point in a café, the router in your home, your internet provider, and every network between them and the server. With plain http, any device on that path can do two things:

• read the full page, including any form you submit and any cookie the site sets
• change the page before you see it, for example by adding a script or by swapping a download link

Most of those devices are run by honest people. That does not help you much, because one compromised or hostile device on the path is enough. HTTPS closes this gap. A device in the middle sees only encrypted bytes, and it cannot change them without the browser noticing.

When is an http page a real risk?

Reading a public page over http exposes what you read. The risk grows with what you give the page, or take from it.

Typing something in

A login form on an http page sends your password as plain text. Anyone on the path can copy it. Many people reuse passwords, so a password leaked this way can open other accounts too. Do not type a password or a card number into an http page. First try the same address with https:// in front. Many sites support both, and the https version is the one to use.

Downloading something

A file fetched over http can be replaced in transit. You ask for an installer, and the network hands you a different file. The browser cannot tell, because nothing in plain http proves the bytes came from the real server. Get downloads from an https page. If the vendor publishes a checksum on an https page, compare your file against it before you run it.

Following links from the page

Someone who can change the page can also change where its links point. A link that says it goes to your bank can go anywhere. For important sites, type the address yourself or use a bookmark.

What does "Not secure" mean in Chrome?

Chrome shows a "Not secure" label in the address bar when you load a site that does not use HTTPS. Chrome's help page explains the label this way: the site does not use a private connection, and someone may be able to view and change the information you send and receive through the site. Its advice is aimed at the site owner, who must secure the site with HTTPS.

That is a statement about the connection only. The label does not say the site is a scam, and it does not say the site carries malware. Chrome's help lists a separate "Dangerous" warning for that, with the advice not to use the site.

The reverse also holds. A clean address bar on an https site means two things: the connection is encrypted, and the server proved it controls the domain name. A certificate proves control of a name. A scammer can control a domain name too, so a phishing site can be "secure" in exactly this sense. Read the domain name in the address bar. The icon next to it cannot tell you who you are talking to.

The three Chrome warnings people confuse

These three look alike to many readers. They mean different things, and only one of them points at a possible attack.

The "Not secure" label in the address bar

This is small text next to the address. The page loads as normal. It means the page came over plain http, with no encryption.

The full-page warning before an http site

This appears only when the setting "Always use secure connections" is on. Chrome's help page says that with this setting on, Chrome upgrades addresses to HTTPS, and it shows a warning before you visit a site that does not support HTTPS. The help page calls it the "Connection is not secure" warning. Chrome asks before it loads the page, and you can choose to continue. The meaning is the same as the label: the site has no HTTPS. It is not a sign that someone is attacking you.

"Your connection is not private"

This is a different error, and a stronger signal. It appears on an https address when the secure connection itself fails. Chrome's help says it means there is a problem with the site, the network or your device. Google's list of common Chrome errors places it with certificate errors such as NET::ERR_CERT_AUTHORITY_INVALID.

The same list names a cause that is harmless: the date and time on your computer or phone are wrong. A certificate is valid only for a set period, so a wrong clock makes a good certificate look invalid. Fix the clock and reload. The list also names antivirus software that scans HTTPS traffic, and company proxy servers, as other causes.

If your clock is right and you are not behind a company proxy, take this error seriously. The site asked for an encrypted connection, and the server on the other end could not prove it was that site. That can be a broken certificate on the server. It can also be a device in the middle trying to read your traffic. On public Wi-Fi, close the tab and do not click through.

You will also see this error on a server that uses a self-signed certificate on Ubuntu, because no public certificate authority has vouched for it. That is expected on your own test machine. On someone else's site, it is a reason to stop.

What changed in Chrome 154?

On 28 October 2025 the Chrome Security Team announced a plan to turn on "Always use secure connections" by default. The plan had two steps:

1. Chrome 147, planned for April 2026, would turn it on for users who opted in to Enhanced Safe Browsing.
2. Chrome 154 would change the default settings of Chrome for everyone. The announcement planned this for October 2026.

The announcement says Chrome will ask for the user's permission before the first access to any public site without HTTPS. It also says Chrome will not keep warning about an insecure site you visit regularly. The warning is meant for a new site, or for one you have not visited recently.

Has Chrome 154 shipped? Yes, and earlier than the announcement planned. Google's Chrome Platform Status gives Chrome 154 a Stable date of 22 September 2026, and Chrome 155 followed on 6 October 2026. Google's Chrome Releases blog listed browser version 154.0.8037.151 in a Stable channel update for ChromeOS on 9 October 2026. Whether the new default is active in your own copy of Chrome is a separate question, and the Google pages checked for this guide did not confirm it. Check it yourself. In Chrome, open Settings, then Privacy and security, then Security, and look for "Always use secure connections". If it is on, you get the full-page warning before a new http site. If it is off, you get only the "Not secure" label.

Is HTTP still commonly used today?

Yes, in two different places, and they carry different risks.

On the public web, you still meet http:// links in old pages and in email newsletters. Often the site behind the link supports HTTPS today, and the old link was simply never updated. With "Always use secure connections" on, Chrome upgrades the address to HTTPS for you.

On your own network, http is normal. Many home routers and NAS (network-attached storage) boxes serve their admin page over plain http, at a local address such as 192.168.0.1. The 2025 announcement explains why these are hard to fix: a private name, such as a local IP address, can point to different machines on different networks. That makes it hard to get a publicly trusted certificate for it.

Will Chrome warn on my router's admin page?

Under the announced default, no. Chrome 154's default is the public-sites variant of the setting, and the announcement leaves private sites out of it. Its examples of private sites are local IP addresses such as 192.168.0.1 and single-label hostnames such as intranet/. The announcement's reason is that http on a private site can only be abused by an attacker who is also on your local network. This is what Google announced. It has not been checked here against a live copy of Chrome 154.

Chrome's Security settings also offer a second option, "Warns you for insecure public & private sites". Choose it, and your router page gets the full-page warning too.

The announcement's reasoning also tells you how to log in to these devices safely. The risk sits on the local network. Log in to your router from your own home network, not from a shared network, and use a strong admin password that you use nowhere else.

A quick check before you open or use an http link

• Reading an article over http: low risk. The network can see what you read.
• A login or payment form over http: stop. Try the address with https://, and leave if that fails.
• A download over http: get the file from an https page instead, or check it against a checksum published over https.
• "Your connection is not private" on an https site: check your device clock. If the error stays, close the tab.
• A router or printer at a 192.168.x.x address: acceptable on your home network, not on a shared one.

My own site shows "Not secure". What do I fix?

If you run the site, the warning is about your server, and the fix is a TLS certificate plus a redirect from http to https. On a Chrome that has the new setting on, visitors to your http address are asked for permission before your page loads. That is a poor first impression for a site that has done nothing wrong.

Start with how HTTP and HTTPS differ on your own server, which covers what changes when you add TLS and why the redirect matters. Then follow getting a free Let's Encrypt certificate with Certbot and Nginx on Ubuntu 24.04. If you have not picked a web server yet, comparing Nginx, Caddy and Traefik as reverse proxies shows how much of the certificate work each one does for you.

An internal tool on a private name cannot get a public certificate, for the reason given above. For that case, run your own certificate authority and add it to the Ubuntu trust store, so your own machines trust the certificate and the warning goes away.

FAQ

Can I get hacked just by opening an http link?

Opening an http page lets anyone on the network path see what you read, and change what you see. The larger risk comes from what you do next: typing a password into the page, or downloading a file from it. On a trusted home network, reading an http page is low risk. On public Wi-Fi, assume strangers can read and change every http page you open.

Does "Not secure" mean the website is a scam?

No. Chrome's help page says the label means the site does not use a private connection, so others may be able to view or change what you send and receive. It says nothing about who runs the site. An honest site can still use plain http, and a scam site can have a valid HTTPS certificate.

What is the difference between "Not secure" and "Your connection is not private"?

"Not secure" means the site uses plain http, with no encryption at all. "Your connection is not private" appears on an https site when the secure connection fails, and Google lists it with certificate errors. A wrong date and time on your device is a common harmless cause. If your clock is right, something on the path could not prove it was the real site, so close the tab.

Why does Chrome ask before opening some http sites now?

On 28 October 2025 Google announced that Chrome 154 would turn on "Always use secure connections" by default for public sites. Chrome 154 reached the Stable channel on 22 September 2026. With the setting on, Chrome asks for permission before the first visit to a public site without HTTPS. To see whether your copy has it on, open Settings, then Privacy and security, then Security.

Will Chrome warn me when I open my router's admin page?

Not under the announced default. Google said the default in Chrome 154 covers public sites only, and private sites such as local IP addresses like 192.168.0.1 are left out. If you pick "Warns you for insecure public & private sites" in Chrome's Security settings, your router page will get the warning too.