Imminent: Non-HTTPS Sites Labeled “Not Secure” by Chrome

/ Blog

On approximately January 31st of this month, version 56 of the Chrome web browser will be released. There is a significant change in the way it displays websites that are not using HTTPS, also known as SSL. This change may confuse your site visitors or surprise you if you are not expecting it.

Starting with the release of Chrome 56 this month, any website that is not running HTTPS will have a message appear in the location bar that says “Not Secure” on pages that collect passwords or credit cards. It will look like this:

non_ssl_pages_labelled_insecure_by_chrome

This is the first part of a staged roll-out that encourages websites to get rid of plain old HTTP.

In an upcoming release Google Chrome will label all non-HTTPS pages in incognito mode as “Not secure” because users using this mode have an increased expectation of privacy.

The final step in the staged roll-out will be that Chrome will label all plain HTTP pages as “Not secure”. It will look like this:

non_ssl_pages_labelled_insecure_by_chrome

The impact on WordPress site owners

So, once again, starting on approximately January 31st of this month, any page on your website that is non-HTTPS and has a password form or credit card field will be labeled as “Not secure” in the location bar by Google Chrome. This includes your WordPress login page.

This may confuse your site visitors who sign in to your website because they may interpret the message to indicate that your website has been compromised. They could also interpret the message to mean that your site has some underlying security issue other than being non-HTTPS.

The current timeline for the release of Chrome 56 is unclear. The official statement from Google indicates it will be released some time in “January”. However, based on the Chromium development calendar it looks like Chrome 56 may be released on January 31st. You’ll notice that calendar says “Estimated stable dates” and is subject to change.

Assuming Chrome 56 will be released on January 31st, that gives you two weeks starting today to get your site running on 100% SSL to avoid the new “Not secure” message appearing on your login pages.

What to do if your site is not HTTPS

We recommend you start by looking at the support documentation that your hosting provider offers to find out how to set up SSL on their system. You will find that some hosting providers offer free SSL and others have a very easy installation method. If you ignore this and decide to configure things manually you may be making life more difficult for yourself.

Google has a technical description of how to implement SSL on your website. You will also find many guides describing how to set up SSL for WordPress with a simple Google search. But definitely start by visiting your hosting provider support documentation or doing a google search for your hosting provider name and ‘SSL installation’ without quotes.

If you have already set up SSL on your site, congratulations!  You are all set and ready for the new change in Chrome 56 coming later this month.

Please share this with the broader WordPress community to promote the use of SSL across all websites and to help other WordPress site owners stay secure.
You should also consider the security of your site visitors. If they’re on public WiFi without a VPN, their traffic is easily sniffed. So providing SSL as a courtesy gives them a nice additional layer of security. Plus it helps your SEO: https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html