It means Chrome will show Not secure when someone types into any field on your plain HTTP pages from October. Move the whole site to HTTPS rather than one form page.

The message in the inbox

Late last week Google sent a message through Search Console to owners of sites that still run on plain HTTP and have forms on them. Many people received it by email as well.

It says that from October, Chrome will show a Not secure warning when a visitor types into a field on those pages, and on every plain HTTP page opened in Incognito mode.

It lists some example pages from your site, and it says plainly that the list is not complete.

Nothing on your site changes today. What changes in October is what your visitors see.

What visitors will see

At the moment, Chrome shows a small grey symbol, an i in a circle, to the left of the address on a plain HTTP page. Clicking it says the connection is not secure. Few people click.

From October, on a page with a form, the words Not secure will appear in the address bar as soon as a visitor starts typing.

That is the worst moment for it: while someone is typing their name and phone number into your quote form.

Since January, Chrome has shown the same words on plain HTTP pages that ask for a password or a card number. October widens that to almost any field.

Which pages it means

The second and third turn a one-page problem into a whole-site problem. A search box or a sign-up field in a shared header or footer means every page has a field someone might type into.

Why the examples look random

Owners open the message, find a blog post from three years ago among the examples, and wonder why it is there.

Usually it is one of those shared fields. Google found a page with a text box on it, and the box happens to live in the footer of every page.

So treat the list as a sample, not the full set. Assume any page with a search box, a sign-up or a form is affected, which on most small business sites means all of them.

Why one secure form is the wrong fix

The tempting answer is to put the contact page alone on HTTPS. It sounds smaller and cheaper.

It rarely is. The shared fields remain on every other page, links between secure and plain pages need managing, and visitors watch the padlock come and go as they click around.

It also solves only this year's problem. Google has said it eventually plans to mark all plain HTTP pages as Not secure, with or without a form.

Moving the whole site once is less work than moving it in pieces, and it ends the question.

A worked example

A water treatment dealer sold and serviced softeners, filters and drinking water systems. Its site offered a free water test through a form, with a search box in the header and a newsletter sign-up in the footer.

The Search Console message listed the water test page, the newsletter archive and two old blog posts about hard water.

The owner's first instinct was to buy a certificate for the water test page alone. The web company pointed out the search box and the footer sign-up: all sixty-odd pages had a field.

So the whole site moved. The host's free certificate went on, every old address redirected permanently to its HTTPS version, and internal links and images were updated so nothing loaded over plain HTTP.

The secure address went into Search Console as a new property, and into Analytics and the Google listing. Most of the two days went on checking pages afterwards.

What moving the whole site involves

A certificate, which many hosts now issue free and renew automatically.

A permanent redirect from every plain address to its secure version, so old links, bookmarks and search results still work.

A sweep for anything still loaded over plain HTTP, such as images, fonts or an embedded map. Any one of them can spoil the padlock on the page that uses it.

Then housekeeping: the HTTPS version added in Search Console, the default address changed in Analytics, and the new address on your listings and social profiles.

If the message never reached you

Search Console messages reach only the people who have access to the site in Search Console. If nobody at the business ever set it up, the message went nowhere.

October happens anyway. Open your site in Chrome and look at the address bar: a padlock and https means you are already in good shape.

If you see the grey i, check whether your pages have any field at all. Most do.

And set up Search Console while you are thinking about it. This will not be the last message Google sends.

The time available

Chrome's change is due in October, roughly eight weeks away. A small brochure site can usually move in days. A site with a shop, a booking system or years of old content needs more care.

Start with your host. Ask whether a free certificate is already available on your plan; many hosts now include one, and some charge.

Then book the work early. Plenty of other owners received the same message, and the people who move sites will be busy through September.

The counter-case

A site with no field anywhere, no form, no search box and no sign-up, will see no new warning in October outside Incognito windows. If yours is genuinely that simple, the deadline matters less.

A site due for replacement this autumn may not be worth moving first. The new one should simply launch on HTTPS.

Neither changes the direction. Plain HTTP is on its way to being labelled insecure everywhere.

For any site with a field on it and a future: move all of it to HTTPS before October.

Before October

  1. Find the message in Search Console or your inbox.
  2. Open each example page it lists.
  3. Look for shared fields in headers and footers.
  4. Ask your host about a free certificate.
  5. Plan the move for the whole site.
  6. Book the work before late September.
  7. Set up Search Console if nobody has.

Step five is the one that saves work later: the whole site moved once, rather than one form now and everything else when Google tightens the rule again.

Security settings left at their defaults are also the subject of the office router still on its factory password.

Frequently asked questions

What did the Search Console message say?

That from October, Chrome will show Not secure when visitors type into fields on your plain HTTP pages, and on all plain HTTP pages in Incognito mode.

Which pages will show the warning?

Any page with a field, including search boxes and newsletter sign-ups in shared headers and footers. On most small business sites, that means every page.

Why does the list include old blog posts?

Usually because a search box or sign-up appears in a header or footer shared by every page. The list in the message is a sample, not the full set.

Can I secure just the contact page?

You can, but shared fields stay on every other page, and Google plans eventually to label all plain HTTP pages. Moving the whole site once is less work.

What does moving to HTTPS involve?

Installing a certificate, redirecting each old address permanently, fixing anything still loaded over plain HTTP, then updating Search Console, Analytics, your listings and social profiles.

What if I never received the message?

Then probably nobody set up Search Console for your site. The change in October applies anyway, so check your address bar in Chrome for a padlock.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Plain HTTP site with a contact form?

Tell us your site address. We will list the pages with fields and explain what moving everything to HTTPS involves.

Start a Conversation