On 22 September 2026 Chrome 154 became the stable version. According to its release notes, Chrome now by default asks the user before connecting to a site over HTTP. Google announced as early as 28 October 2025 that with Chrome 154 the "Always Use Secure Connections" setting for public sites becomes the default for all users. For a site without HTTPS this means a warning that the visitor sees before reaching the page.
What Chrome 154 changes
The setting has existed since 2022 as an opt-in. When it is on, Chrome tries to open every connection over HTTPS and shows a warning if HTTPS is not available. Now, by default, Chrome asks the user for permission before the first visit to a public site without HTTPS.
The warning can be bypassed, so the visitor decides whether to continue. Chrome warns only for a new or not recently visited site, and the user can turn the setting off. Private addresses, such as 192.168.0.1, and internal names without a dot are not part of the public variant of the setting. Administrators of company computers control the behavior with the HttpsOnlyMode policy.
Google published data from a trial in Chrome 141. Half of the users saw fewer than one warning a week, and 95% saw fewer than three. The warnings were far below 3% of page loads, and Google expects their number to fall as more sites move to HTTPS.
What to do
First look at how the site behaves from the outside. Open your address with https://, with and without www. You should not see a certificate error. In cPanel the state of the certificates is under Security > SSL/TLS Status.
If you open your own site often, you may not see the warning, because Chrome warns for a new or not recently visited site. So also check with the command below, which does not depend on the browser.
# From your computer or cPanel > Terminal, read-only
curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' http://primer.bg
curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' https://primer.bg
The first command should return 301 https://primer.bg/, and the second 200. If the certificate has expired or is not valid for the address, curl stops with a message that starts with curl: (60). Repeat both with www.primer.bg.
Then publish your address with https:// everywhere you give it to people. In Settings > General both WordPress addresses should also start with https://. Google notes that many HTTP connections that redirect straight to HTTPS have so far been invisible to users. How to fix the certificate, the redirect and mixed content is in the HTTPS guide.
What we do
SSL is part of WordPress maintenance, together with PHP updates and off-server backups. If the check shows a certificate error, or you cannot turn on the redirect, describe what you see in the inquiry form.
Frequently asked questions
What did Chrome 154 change for sites without HTTPS?
Chrome 154 became the stable version on 22 September 2026, and by default it asks the user before opening a public site over HTTP. A site without HTTPS therefore shows a warning before the visitor reaches the page. The "Always Use Secure Connections" setting has existed since 2022, but until then it was opt-in.
Can visitors still get to the site past the Chrome warning?
Yes. The Chrome 154 warning for a site without HTTPS can be bypassed, and the visitor decides whether to continue. Users can also turn the "Always Use Secure Connections" setting off altogether.
How often will visitors see the warning?
Chrome warns only for a new or not recently visited site, not on every visit. In the trial with Chrome 141, half of users saw fewer than one warning a week and 95% saw fewer than three. Google expects the number to fall as more sites move to HTTPS.
Does the warning apply to internal addresses and company computers?
Private addresses such as 192.168.0.1 and internal names without a dot are not part of the public variant of the setting in Chrome 154. On company computers, administrators control the behaviour with the HttpsOnlyMode policy.
Why do I not see the warning on my own site?
Chrome 154 warns only for a new or not recently visited site, so if you open your own site often you may see nothing. A first-time visitor sees something different. Check the redirect with a command that does not depend on the browser instead.
How do I check that my site redirects from HTTP to HTTPS?
From your computer or cPanel's Terminal, run curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' http://primer.bg with your own address. The command only reads and should return 301 https://primer.bg/, while the same command with https:// should return 200. Repeat both for the www address.
How do I tell whether my site's SSL certificate is valid?
Open the address with https://, with and without www, and see whether the browser shows a certificate error. In cPanel the state of the certificates is under Security > SSL/TLS Status. If the certificate has expired or does not cover the address, curl stops with a message starting with curl: (60).
What else should I change in WordPress when moving to HTTPS?
Both WordPress addresses in Settings > General should start with https://. Use the https:// address everywhere you give it to people as well. Fixing the certificate, the redirect and mixed content is covered in the HTTPS guide.