Your website without HTTPS: Chrome's 2026 warning and how to avoid it

Updated: 10 November 2026

If your hotel website still opens with http:// rather than https://, Chrome will ask guests for permission before going in. Google announced this in October 2025 for Chrome 154. This guide sums up what we could check on 10 November 2026 on Google's security blog, the Chromium blog, Chrome Help, Google Search Central and Let's Encrypt, and clearly flags what we could not confirm.

The short answer

The essentials:

On 28 October 2025 the Chrome security team announced that, with Chrome 154 (October 2026), the "Always Use Secure Connections" setting will be on by default for public sites: Chrome will ask the user's permission before the first access to any public site without HTTPS.
The fix is HTTPS across the whole website, including the booking engine, plus a redirect from http:// to https://.
The certificate can be free: Let's Encrypt describes itself as a free, automated and open certificate authority (7 October 2026).
Not confirmed: as of 10 November 2026 we found no official note confirming that Chrome 154 has already reached all users on the stable channel. Best to prepare as if it had.

What changes in Chrome, and when

Timeline announced by Google:

Chrome 68 (July 2018): Chrome started marking all HTTP sites as "Not secure" (Chromium blog, 8 February 2018).
Chrome 147 (April 2026): according to the 2025 announcement, the warning for public sites would be turned on for Enhanced Safe Browsing users, over 1 billion users according to Google.
Chrome 154 (October 2026): the warning is on by default for all users.
It does not apply to private sites such as local IP addresses: the change is for public sites, which is what a hotel website is.
Google says the warning only appears on new or not recently visited sites; in a Chrome 141 experiment the median user saw fewer than one warning per week. That is why a first-time guest is exactly who will see it.

What the guest sees

What Chrome Help says:

With the setting on, if a site does not support HTTPS, Chrome shows a "Connection is not secure" warning and asks before opening it.
If the site opens over HTTP, Chrome marks it "Not secure" and advises against entering private or personal information: exactly what a booking form asks for.
If the certificate has a problem (for example, it has expired), the user sees a different full-page error: "Your connection is not private".
Users can turn these warnings off, but do not count on it. We could not check the exact wording of the warning in every language.

HTTPS and Google

What Google says about rankings:

In August 2014 Google announced that HTTPS is a ranking signal, then "very lightweight" and affecting fewer than 1% of global queries.
In September 2022 Google Search Central restated that HTTPS is one of the page experience signals and launched an HTTPS report in Search Console. It does not say how much it weighs in rankings.
Google treats moving from HTTP to HTTPS as a site move with URL changes: permanent server-side redirects (301), which do not lose PageRank, and internal links, sitemap and canonical pointing to the new URLs (page updated on 20 August 2026).
Not confirmed: how AI assistants treat a website without HTTPS.

Free certificate with Let's Encrypt

No need to pay for the certificate:

Let's Encrypt is free and run by the nonprofit ISRG.
Today most of its certificates last 90 days. From 10 February 2027 new or renewed certificates will last 64 days by default, and it plans 45 days by February 2028 (announcements of July and October 2026).
So renewal must be automatic: Let's Encrypt recommends renewing at about two-thirds of the certificate's lifetime, automating installation too and setting alerts in case it fails.
Our tip: ask whoever hosts your website whether they install and renew the certificate automatically, and get them to confirm it in writing.

Common mistakes

What we see most on hotel websites:

Expired certificate: if renewal is not automatic, one day the website shows "Your connection is not private". With 64-day certificates the risk grows.
Mixed content: the page is on HTTPS but loads images, videos or scripts over http://. Chrome upgrades them to HTTPS and blocks them if they fail to load; mixed images can trigger "Not secure" (Google security blog, October 2019).
Booking engine on another domain: Chrome's warning applies to any public site without HTTPS, so the "Book" button must not lead to an http:// address. Our recommendation, applying Chrome's general rule.
No redirect: the website has HTTPS but still opens over http:// too. Redirect everything with a 301 to https://.
Old links: sitemap, canonical, Google listing, social profiles and email signatures still point to http://.

How to check

In ten minutes:

Type your website address in Chrome starting with http:// and check that it ends up on https:// without warnings. Google recommends turning on "Always Use Secure Connections" now to spot sites that need migrating.
Do the same with the booking engine and with payment pages or forms.
Click the icon to the left of the address to see whether the connection is secure and when the certificate expires.
Use Lighthouse's mixed content audit, which Google cites for finding resources loaded over http://.
In Search Console, check the HTTPS report, which lists the issues that stop pages being served over HTTPS.

How iQuota helps

iQuota makes independent properties available to AI assistants with direct booking, payment at the property and 0% commission, with the price and terms each property sets. We cannot guarantee that an AI assistant will recommend you.

Want AI to give your real details, with direct booking and no commission? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

When does the Chrome warning start?

Google announced it for Chrome 154, in October 2026, on by default for all users. We could not confirm in an official source that it has reached everyone as of 10 November 2026.

Do I have to pay for an SSL certificate?

Not necessarily. Let's Encrypt issues free, automated certificates; what matters is that renewal is automatic.

My website already shows the padlock. Am I safe?

Also check that http:// redirects to https://, that there is no mixed content and that the booking engine uses HTTPS too.

Does HTTPS help me rank on Google?

Google has said since 2014 that it is a ranking signal, then very lightweight, and in 2022 it listed it among the page experience signals. It does not say how much it weighs today.

What if the booking engine belongs to another company?

Check that its address starts with https://. If not, ask them: Chrome's warning applies to any public site without HTTPS.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά