How to Fix Chrome Not Using HTTPS
If Chrome is not using HTTPS, the problem is usually a browser setting, a website configuration issue, or a security feature blocking secure connections.
This guide explains the most common causes and the exact steps to restore HTTPS in Chrome while keeping your browsing secure.
Why Chrome may load HTTP instead of HTTPS
HTTPS encrypts traffic between your browser and a website using TLS, helping prevent interception and tampering.
When Chrome falls back to HTTP, it is often because the browser cannot complete a secure connection or the site does not properly support HTTPS.
- HTTPS-First Mode is disabled in Chrome settings.
- A browser extension is rewriting or blocking secure requests.
- Cached redirects or cookies are sending you to old HTTP URLs.
- Mixed content or certificate problems are preventing a secure page from loading.
- The website is misconfigured and does not redirect all traffic to HTTPS.
Check Chrome’s HTTPS settings first
Chrome includes a feature called HTTPS-First Mode, which tries to upgrade navigations to secure connections whenever possible.
If this setting is off, Chrome may continue opening sites in HTTP when a secure version is available.
How to enable HTTPS-First Mode
- Open Chrome.
- Go to Settings > Privacy and security.
- Select Security.
- Turn on Always use secure connections or the equivalent HTTPS-First option.
After enabling it, revisit the site and type the address with https:// manually.
If the site supports HTTPS, Chrome should stay on the secure version.
Clear cached redirects and old site data
Chrome can remember old HTTP redirects, cookies, or cached resources that keep sending you to an insecure address.
Clearing that data often resolves the issue quickly.
What to clear
- Cached images and files
- Cookies and other site data
- Saved redirects from the specific domain
How to do it
- Open Settings > Privacy and security > Delete browsing data.
- Select Cookies and other site data and Cached images and files.
- Choose an appropriate time range, such as Last 24 hours or All time.
- Reload the site and test again with https://.
If the site still opens on HTTP, try opening it in an Incognito window.
That can reveal whether a stored cookie or extension is part of the problem.
Test whether an extension is blocking HTTPS
Browser extensions such as ad blockers, privacy tools, DNS filters, and security add-ons can interfere with redirects or certificate validation.
A misbehaving extension may strip secure links, block scripts, or force an outdated URL.
How to isolate extension issues
- Open a new Incognito window, where most extensions are disabled by default.
- Visit the same site using https://.
- If it works in Incognito, disable extensions one by one in chrome://extensions.
Pay special attention to extensions that modify headers, proxy traffic, or rewrite URLs.
Re-enable only the tools you trust and need.
Look for certificate and connection errors
If Chrome refuses to use HTTPS, it may be detecting an invalid, expired, or untrusted certificate.
Common examples include self-signed certificates, mismatched domain names, missing intermediate certificates, and certificate expiration.
What certificate errors mean
- CERT_COMMON_NAME_INVALID: the certificate does not match the domain.
- CERT_DATE_INVALID: the certificate is expired or not yet valid.
- CERT_AUTHORITY_INVALID: the issuing certificate authority is not trusted.
- Mixed content warnings: the page loads some resources over HTTP, weakening security.
For site owners, the fix is usually to reinstall the certificate correctly and ensure the server sends the full chain.
For users, do not bypass certificate warnings on unfamiliar websites, since they can indicate a man-in-the-middle attack or configuration problem.
Force HTTPS in the address bar
Sometimes Chrome only needs a direct prompt.
Type the full secure URL manually, including https://, and see whether the site loads correctly.
If the site supports HSTS, Chrome may automatically prefer HTTPS after the first successful secure visit.
For frequently visited sites, bookmark the secure version so you always open the correct address.
This is especially useful for banking, email, admin dashboards, and e-commerce accounts.
Check the website’s HTTP-to-HTTPS redirect
When a website is configured properly, all HTTP traffic should redirect to HTTPS using a 301 or 302 redirect.
If that redirect is missing or broken, Chrome may keep loading the insecure version.
Signs the redirect is the issue
- The site opens on HTTP even after typing https://.
- The homepage loads securely, but internal pages revert to HTTP.
- Links within the site point to hardcoded HTTP URLs.
Website owners should verify redirects at the server level, in CDN rules, and in application code.
Check Apache, Nginx, Cloudflare, and CMS settings to ensure every page consistently routes to HTTPS.
Review HSTS and mixed content behavior
HTTP Strict Transport Security, or HSTS, tells browsers to use HTTPS for a site automatically.
If a domain previously had an HSTS policy and the secure setup is now broken, Chrome may behave differently from other browsers because it is enforcing a remembered rule.
Mixed content is another common obstacle.
A page may load over HTTPS but still pull images, scripts, fonts, or APIs over HTTP.
Chrome can block those requests, which makes the site appear broken or unsafe.
- Update image URLs, script URLs, and stylesheet URLs to HTTPS.
- Use relative or protocol-independent URLs where appropriate.
- Audit third-party embeds such as analytics, widgets, and payment scripts.
Make sure Chrome and your system are up to date
Outdated browser builds can fail on modern TLS configurations, especially when servers require newer cipher suites or security standards.
Operating system updates also matter because Chrome depends on system certificate stores and network libraries on some platforms.
- Update Chrome through chrome://settings/help.
- Install pending operating system updates.
- Restart the browser after updates finish.
If Chrome is outdated, it may not trust newer certificates or may fail to negotiate secure connections properly.
Reset Chrome settings if the issue persists
If none of the above steps works, Chrome’s configuration may be corrupted.
A reset can restore default behavior without deleting all data.
What a reset can fix
- Broken startup behavior
- Altered search or proxy settings
- Unexpected security preferences
- Policy changes from software or extensions
Go to Settings > Reset settings > Restore settings to their original defaults.
This is often the last browser-side step before checking network equipment or the site itself.
What site owners should verify
If you manage the website, fixing Chrome not using HTTPS may require server-side changes rather than browser changes.
A secure site should present a valid certificate, redirect all HTTP traffic, and avoid insecure resources.
- Install a valid TLS certificate from a trusted certificate authority such as Let’s Encrypt, DigiCert, or GlobalSign.
- Redirect all HTTP requests to HTTPS at the web server or CDN level.
- Update canonical URLs, sitemap entries, and internal links.
- Enable HSTS only after confirming HTTPS works everywhere.
- Test the site with Chrome DevTools, SSL Labs, and security headers checkers.
When to suspect a network or proxy problem
Public Wi-Fi, corporate proxies, antivirus HTTPS scanning, and custom DNS tools can all interfere with secure browsing.
These systems may intercept TLS traffic, present their own certificates, or block certain domains.
If Chrome behaves differently on another network, the issue may be outside the browser.
Test using a mobile hotspot or another trusted connection to compare results.
If the secure version works elsewhere, inspect the proxy, VPN, or security software on the original network.
Quick checklist for fixing Chrome not using HTTPS
- Enable Chrome’s Always use secure connections setting.
- Manually open the site with https://.
- Clear cache, cookies, and site data.
- Disable extensions and test in Incognito.
- Check for certificate errors and mixed content.
- Update Chrome and your operating system.
- Reset Chrome if settings appear corrupted.
- Verify server-side redirects, certificates, and HSTS if you own the site.
Using these steps, you can usually identify whether the issue is in Chrome, the website, or the network path between them.