This change may confuse your site visitors or surprise you if you are not expecting it.

Starting with the release of Chrome 56 this month, any website that is not running HTTPS will have a message appear in the location bar that says “Not Secure” on pages that collect passwords or credit cards.

It will look like this:

This is the first part of a staged rollout that encourages websites to get rid of plain old HTTP.

In an upcoming release Google Chrome will label all non-HTTPS pages in incognito mode as “Not secure” because users using this mode have an increased expectation of privacy.

The final step in the staged rollout will be that Chrome will label all plain HTTP pages as “Not secure”. It will look like this:

The impact on WordPress site owners

So, once again, starting on approximately January 31st of this month, any page on your website that is non-HTTPS and has a password form or credit card field will be labeled as “Not secure” in the location bar by Google Chrome. This includes your WordPress login page.

This may confuse your site visitors who sign in to your website because they may interpret the message to indicate that your website has been compromised. They could also interpret the message to mean that your site has some underlying security issue other than being non-HTTPS.

The current timeline for the release of Chrome 56 is unclear. The official statement from Google indicates it will be released some time in “January”. However, based on the Chromium development calendar it looks like Chrome 56 may be released on January 31st. You’ll notice that calendar says “Estimated stable dates” and is subject to change.

Assuming Chrome 56 will be released on January 31st, that gives you two weeks starting today to get your site running on 100% SSL to avoid the new “Not secure” message appearing on your login pages.

What to do if your site is not HTTPS

We recommend you start by looking at the support documentation that your hosting provider offers to find out how to set up SSL on their system. You will find that some hosting providers offer free SSL and others have a very easy installation method.

If you ignore this and decide to configure things manually you may be making life more difficult for yourself.

Google has a technical description of how to implement SSL on your website. You will also find many guides describing how to set up SSL for WordPress with a simple Google search.

But definitely start by visiting your hosting provider support documentation or doing a google search for your hosting provider name and ‘SSL installation’ without quotes.

If you have already set up SSL on your site, congratulations!  You are all set and ready for the new change in Chrome 56 coming later this month.

Please share this with the broader WordPress community to promote the use of SSL across all websites and to help other WordPress site owners stay secure.

SSL Security

Credits to Suma Designs

Starting in January of 2017, Google’s Chrome browser will start flagging some websites that don’t use web encryption as “Not Secure”—the first step in Google’s eventual plan to shame all sites that don’t use encryption.

In the last couple of years, the web has seen a tremendous rise in the number of websites that use encryption, which is displayed by that little green lock next to the site’s address and an extra “s” at the end of HTTP. The increase in the use of HTTPS web encryption has been part of a collective effort to improve security and privacy on the web, often under the banner of the campaign “Encrypt All The Things.”

Read more: This Chrome Bug Makes It Hard to Tell If You’re on the Real Facebook

At the beginning of this year, Google hinted—without announcing it officially—that it was going to flag all unencrypted websites as insecure, as Motherboard reported. At the time, Parisa Tabriz, who manages Google’s security engineering team, said that Google’s intention was to “call out” websites that still were on HTTP as “unsafe.”

On Thursday, Google officially announced its anti-HTTP plan. The company isn’t going to shame all unencrypted websites all at once, but start only with HTTP sites that ask users to input passwords or credit cards. These sites will be flagged as “Not secure” in the Chrome address bar.

How Chrome will flag HTTP pages that ask users for passwords or credit card numbers. (Image: Google)

Then, in the future—Google is not saying exactly when yet—Chrome will flag all sites that don’t use TLS encryption as “Not secure” and also display a red triangle indicator, which Chrome already uses when users go to a dangerous website.

How Chrome will flag all HTTP pages in the future.

“We definitely do plan to label all HTTP pages as non-secure eventually,” Emily Schechter, the Chrome Security product manager, told Motherboard, explaining that the company didn’t want to all of a sudden flood users with warnings. “We really wanted to be careful about it and we wanted to get it right.”

Schechter explained that Google’s main worry is that displaying alerts for all HTTP sites right away would lead users to see too many warnings and, eventually, ignore them. In other words, Google wants to educate users about the risks of unencrypted websites striking the right balance and without leading them to what’s called as “warning fatigue,” a term that indicates when users get so used to warnings that they stop paying attention.

“We definitely do plan to label all HTTP pages as non-secure eventually.”

Google also wanted to announce the change before it was implemented to give webmasters time to migrate to HTTPS and not get caught by surprise, Schechter said.

While it seems like a small change, HTTPS provides multiple protections for users. Not only does it ensure that hackers and spies can’t easily intercept passwords and other sensitive data travelling on the internet, it also ensures that the site you’re looking at really is the site you want, and not an imposter. Without HTTPS, it’s trivial for a hacker sitting in the same public WiFi you’re using, or government spies, to spy on you and interfere with the sites you go to trick you into giving up sensitive information.

With this move, Google is pushing for even more HTTPS adoption. And at this point, an HTTPS-only future seems inevitable. Google reported that nowadays, more than half of the sites visited by Chrome users are encrypted already.