Google Chrome 56 arrives with a warning to non-secure HTTP web pages

Chrome 56 marked an important moment for site owners by making insecure forms more visible to users.

What changed

The release began marking HTTP pages that collect passwords or card details as not secure, directly in the address bar. Previously the absence of encryption was communicated by the absence of a padlock, which almost nobody notices.

Why the wording mattered

Moving from a missing positive signal to a present negative one is a large change in practice. A visitor who would never have looked for a padlock will read the words next to the address, and a login form sitting under a warning label is a conversion problem as much as a security one.

What site owners had to do

For anyone running a form that takes a password or a payment, the answer was to migrate, and quickly. For everyone else it was a clear signal of direction: the warning was announced as the first step toward marking all HTTP pages as insecure, which is exactly what followed.

The wider effect

Certificates had already become cheap and, in many cases, free and automated. Combined with browser pressure, that turned encryption from something a site added when it handled sensitive data into the default state of a website.