HTTPS and mixed content for online stores

Chrome now treats plain HTTP as the exception. With Chrome 154, released in autumn 2026, the Always Use Secure Connections setting is on by default for all users: Chrome tries HTTPS first and asks the shopper's permission before loading a public site that lacks HTTPS. For a store, that warning sits right between an ad click and the product page. The fix is to make every URL, asset and redirect HTTPS-only.

What changed in Chrome

Google announced the change in October 2025 and rolled it out in two steps: first for Enhanced Safe Browsing users (Chrome 147, April 2026), then for everyone in Chrome 154. A few details matter for store owners:

• It covers public sites only. Local addresses and intranet names are excluded.
• Chrome does not keep warning about sites someone visits regularly. New and occasional visitors, the ones arriving from ads, search or a newsletter, are the ones who see it.
• The warning can be bypassed, but every extra click before the product page costs you shoppers.

Step 1: check that every page works over HTTPS

1. Open your home page, a category, a product, the cart and checkout with https://. Each one must load with no certificate warning.
2. Check the certificate covers both example.com and www.example.com, and that it renews automatically.
3. Make sure any subdomain you link to (blog, help centre, image CDN) also has a valid certificate.

Step 2: collapse redirects to one hop

Typing example.com should reach the final URL in a single redirect, for example http://example.com → https://www.example.com/. Chains such as HTTP → HTTPS → www → trailing slash add latency on every visit and lose a little signal at each hop.

Google also points out that sites using HTTP only to redirect should finish migrating, since that first insecure request used to be invisible. In practice:

• Use https:// URLs in your sitemap, canonical tags and internal links.
• Update ad destinations, email templates, social profiles and marketplace listings.
• Consider an HSTS header once everything works, so browsers go straight to HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Start with a short max-age and raise it once you are sure every subdomain supports HTTPS.

Step 3: remove mixed content

A page can be HTTPS and still load assets over HTTP. Old product descriptions are the usual culprit: images pasted years ago with http:// URLs, or embeds from a former theme or app.

• Search product and category descriptions, CMS pages and theme files for src="http://.
• Replace them with https:// or relative URLs, after checking the asset exists over HTTPS.
• Open the browser console on a few product pages: mixed-content warnings are listed there.

How Averifly helps

Averifly checks your certificate, flags pages that need multiple redirects and HTTPS pages that load images over HTTP, across a sample of your store. It sits alongside the Core Web Vitals checks and the trust pages shoppers look for. Run a free scan to see what to fix first.