Why Chrome’s HTTPS-Only Shift in 2026 Changes Everything for Your Intranet

You may already know that encryption is good practice. But what if your browser begins to refuse unencrypted connections by default? That shift is arriving and it has direct implications for how your organisation’s web-assets, intranet and legacy systems function. As administrators and managers you’ll want to understand what changes, when, and how to act so that this isn’t a surprise-driven incident.

What’s Changing and When

Key dates

• In April 2026, with the arrival of Google Chrome 147, the “Always Use Secure Connections” setting will be enabled by default for users who are enrolled in Enhanced Safe Browsing. (Google Online Security Blog)
• In October 2026, with the rollout of Google Chrome 154, the setting becomes enabled by default for all users, for public websites. (Google Online Security Blog)
• Today (October 2025) you have roughly 12 months to prepare before this becomes the de facto default.

What the change means

• Chrome will attempt to load HTTPS first for every connection. (Android Authority)
• If a site isn’t served over HTTPS (public site), Chrome will display a warning and require explicit user confirmation before proceeding. (Search Engine Journal)
• Private/internal sites (intranets, local IP devices) are treated differently: the risk is lower and migration challenges remain, but this doesn’t mean they can be ignored. (Google Online Security Blog)

Why This Matters for Your Organisation

The risk of “just one” HTTP link

Although HTTPS adoption has soared (~95-99 % of traffic) for public sites globally, the remaining fractions still pose disproportionate risk. (Google Online Security Blog)

• Attackers can exploit a single unsecured HTTP navigation to hijack a user’s session, redirect to malicious content, inject malware or harvest credentials. (Google Online Security Blog)
• Some HTTP pages immediately redirect to HTTPS, meaning users never see the “Not Secure” warning—but the insecure hop is still exploitable. (Google Online Security Blog)
• For organisations, a legacy HTTP‐only endpoint (public web or internal) could now become a visible liability once Chrome starts warning users or blocking access.

Intranet and legacy systems – the hidden challenge

• Many internal corporate sites, device management portals, routers or other local network assets still rely on HTTP because obtaining trusted HTTPS certificates for non-public/private names is technically difficult. (Google Online Security Blog)

• While Chrome’s policy focuses on public sites for the October 2026 rollout, internal systems aren’t immune:

  • The presence of an HTTP only internal system may still trigger warnings if accessed externally or through proxies.
  • Security best practice mandates modernising internal access channels as well, especially if users access via remote, VPN or cloud-bridge.
• Failing to account for intranet/legacy devices creates an opportunity for attackers inside or outside the network to exploit weaker links.

Compliance, assurance & governance implications

• For organisations subject to data-protection laws or governance frameworks (for example in South Africa, the Protection of Personal Information Act — POPIA), encryption on transmission is increasingly a baseline expectation.
• A visible browser warning for your web interface may erode user trust, raise the risk of incidents, and complicate vendor or partner assurance.
• Senior management should view this not as a technical nicety, but as a security and service-continuity risk. If users cannot access a service because of unaddressed HTTP links, the business impact may be larger than you expect.

Actionable Guide for Administrators & Management

Here’s a structured approach to preparing for the change — broken into phases and ownership roles (technical admin vs management oversight).

Phase 1: Audit & inventory (Now)

Technical Admin:

• Compile an inventory of all web-facing sites (public and internal). Include: hostnames, IP addresses, protocol (HTTP/HTTPS), certificate status, redirects, device portals (printer, router, network­console).
• Flag any endpoints that currently respond only via HTTP (no HTTPS).
• Identify all internal/intranet systems (single-label hostnames, IP addresses, “intranet/”, “printer.local”, etc.) that may be affected.
• Use the Chrome setting manually today: navigate to chrome://settings/security ➜ enable Always Use Secure Connections in test environment to surface what warnings users will see. This gives early indication of problem areas. (Search Engine Journal)

Management Oversight:

• Assign responsibility for the audit results (who owns website inventory, who will fix legacy systems).
• Schedule initial review meeting: date by which audit must be complete (e.g., 31 December 2025).
• Ensure budget for remediation (certificate procurement, legacy system upgrades, developer resources) is factored in.

Phase 2: Remediation & migration (Now through H1 2026)

Technical Admin:

• Public sites: Ensure every public-facing endpoint supports HTTPS and that there are no plaintext HTTP hops (redirects count).

• Internal/intranet: Develop plan to add HTTPS support to internal systems. Options include:

  • Using internal CA or issuing trusted certificates for internal hostnames/IPs.
  • Replace HTTP-only systems with HTTPS-enabled alternatives.
  • For devices lacking certificate support (old printers, routers), limit their usage or place them behind segregated networks/VLANs until migration.
• Configure HSTS (HTTP Strict Transport Security) where possible to force HTTPS.
• For enterprises: Deploy Chrome policy or GPO enforcing “Always Use Secure Connections” today for controlled roll-out and to monitor impact in your environment.
• Test user-experience: With the setting forced, access each critical service as a typical user would. Resolve any broken links, warnings, or blocked content.
• Establish monitoring: Use web analytics or SIEM to flag HTTP traffic in the environment, especially for critical web apps or devices.

Management Oversight:

• Review progress monthly: How many sites remain HTTP only? What are the blockers (budget, legacy hardware, vendor dependencies)?
• Close the gap: By H1 2026 you should aim for zero public HTTP endpoints and a clear path for internal migration.
• Ensure change management: communicate to users if access will change, especially for intranet or remote access systems.

Phase 3: Pre-roll-out check & user communication (Mid-2026)

Technical Admin:

• Verify Chrome version coverage: Prepare for April 2026 pilot with Chrome 147 (Enhanced Safe Browsing users). This is your “dress rehearsal”. (Google Online Security Blog)
• Validate fallback & exception policy: If there are legacy systems that cannot migrate before cut-off, plan for exceptions or compensating controls (VPN access only, network segmentation, strict access control).
• Document internal guidance: For any residual internal-only HTTP links, provide user guidance or internal IT policy explaining risk and usage limits.

Management Oversight:

• Inform staff and users: Send communication to all employees explaining that starting April-October 2026 browsers may show warnings if they access certain sites; emphasise that this is proactive for everyone’s security.
• Update internal policies to reflect that unencrypted traffic is unacceptable for new services — retroactive remediation must be complete.
• Ensure contract & vendor review: Are any third-party services (partner portals, cloud-apps) still operating on HTTP? Engage vendors now to synchronise migration timelines.

Phase 4: Full roll-out and ongoing governance (October 2026 onward)

• After Chrome 154 ships and the setting is default for all users, monitor for any new warnings or blocked access incidents.
• Incorporate HTTPS-first into your service-delivery standards: any new service must support HTTPS from day one.
• Periodically re-audit (at least annually) all web-endpoints (public & internal) for unintended HTTP exposure.
• For intranet/IoT devices: continually refresh asset inventory to catch devices deployed without HTTPS—especially as technology ages and threat landscape evolves.

Special Considerations: Intranet, Legacy Devices & Internal Networks

• Although public websites are the initial focus, many organisations overlook intranet hostnames, single-label devices, local IP addresses (e.g., 192.168.0.1), or embedded device-web UIs. These are still risk-vectors if:

  • Access occurs via remote/ VPN, bridging a hostile network;
  • Internal segmentation fails and an attacker obtains a foothold inside.
• You may rely on internal HTTP for devices because trusted certificates for private names are complex — this is called out in the announcement. (Google Online Security Blog)
• Best practice: create isolated management networks, deploy HTTPS capable consoles, or decommission unsupported devices. Consider certificate automation (e.g., internal ACME server) for internal services.
• If you must continue using HTTP for internal-only device access, treat this as a compensated risk: limit access strictly, monitor for anomalies, and ensure the device doesn’t serve public traffic.

Executive Summary for Management

• By October 2026 your browsers (via Chrome 154) will by default force HTTPS first and will show warnings when users hit HTTP websites.
• Your organisation’s remaining HTTP endpoints (public or internal) become visible risks: either through user disruption (blocked access/warnings) or security exposure (session hijack, data compromise).
• You have today to begin remediation and to treat this as a strategic update, not just a technical tweak: budgets, policies and operational audits need to reflect the change.
• Ultimately, moving to full HTTPS is not optional — it becomes baseline hygiene for modern web services and a necessary step for compliance, trust and service continuity.

Start your audit this week. Identify all HTTP endpoints. Prioritise remediation before April 2026.

Further thoughts…

Preparing now gives you control, not just reaction. The change is market-wide (and not limited to Chrome). While users may still disable warnings, the expectation is shifting quickly: unencrypted connections will increasingly raise eyebrows from both users and auditors. For administrators, this is not only a better security posture, but a chance to optimise your web-stack (certificate automation, HSTS, legacy device refresh) and reinforce organisational trust. For management, ensure the change is resourced, communicated, and embedded into your IT governance and service delivery frameworks.