Google will mark non-encrypted websites with a scarlet letter

Chrome can mark unencrypted sites with a red "X," but only as an optional feature for now.

Google Chrome users may now enable a mark of shame when visiting websites that don’t use HTTPS encryption.

As Motherboard reports, these sites will have a red “X” and gray padlock icon next on the left side of the address bar. Google currently uses this icon to flag instances where encryption doesn’t work properly, but may also expand it to unencrypted HTTP sites.

For now, the icon is available as an optional flag in Chrome. Users can enable it by visiting chrome://flags, scrolling to “mark non-secure as,” and choosing “mark non-secure origins as non-secure.” An unnamed Google employee told Motherboard that the company will the goal is to make this option default “someday, hopefully.”

What’s the holdup? As one developer noted when Chrome’s Security Team first proposed the idea in 2014, in many cases getting an HTTPS certificate isn’t free. Hitting HTTP sites with a scarlet letter might not go over well with webmasters, especially for smaller sites.

Still, many major sites now use HTTPS, and Google has been factoring HTTPS into its search rankings (albeit as a minor ranking signal) since 2014.

Why this matters: With HTTPS, data travelling to and from the web browser is better-protected against surveillance and hijacking of sensitive data. The only drawback, aside from the effort required by webmasters to implement it, is that it’s a little bit slower than non-encrypted HTTP connections. Although Google has advocated the use of HTTPS for several years, the search giant has tried to avoid being too heavy-handed. The new icon is another way to nudge more sites to make website encryption the norm.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags chrome

More about Google

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jared Newman

Latest Videos

More videos

Blog Posts