Chrome Now Warns on HTTP Pages With a Password Box

What changed this week

Chrome 56, released yesterday, labels plain HTTP pages that contain a password or credit card field Not secure, in the address bar.

Firefox 51, out the day before, shows a struck-through padlock on plain HTTP pages that collect passwords.

Pages without those fields look the same as last week. But on a typical small business site, more pages carry a password box than the owner expects.

Google announced the change in September, as part of a longer plan to eventually mark all plain HTTP pages Not secure. It has given no date for that.

Which pages carry a password box

• The site's own login page, where staff edit the content.
• Customer or member logins, for accounts, bookings or records.
• Checkout pages that take card numbers on the site itself.
• Payment or deposit forms with card fields.
• Login boxes in a sidebar or footer, repeated on every page.

The last is the surprise. A small login box in a sidebar or footer puts a password field on every page that shows it, so every one of those pages now carries the label, home page included.

Why a password box is singled out

On a plain HTTP page, whatever someone types travels across the network as readable text.

Anyone in a position to watch the connection can read it, and on the shared Wi-Fi at a coffee shop or a motel, that can be the person at the next table.

Passwords are the worst thing to lose this way, because people reuse them. One captured password can open an email account, a bank login or the registrar account behind the domain.

Card numbers need no explanation.

Who sees the warning first

On most small business sites, the first person to see the new label is the owner or office manager, logging in to update the site.

Customers see it at the point of logging in to an account or entering card details, which is exactly when they decide whether to hand you something they value.

That timing is what makes a short label in the address bar matter.

Logins beyond the website

The label appears on any plain HTTP page with a password box, not only on the website itself.

Webmail reached through your own domain, an old bookmark for the hosting control panel, a booking system's staff login: these are where staff type the passwords that matter most, and some still load over plain HTTP.

Check each one. Most hosts provide a secure address for webmail and the control panel, and the old bookmarks are worth replacing this week.

Securing only the login page is not enough

The quick fix some owners will ask for is a certificate on the login page alone. It removes the label there, and leaves the problem in place.

After someone logs in, the browser sends a session cookie with every request to prove who they are.

If the rest of the site is plain HTTP, that cookie travels as readable text too, and whoever captures it can use the account without the password.

Half-secured sites also break in odd ways, with redirects bouncing between versions and logins that do not stick. The lasting fix is HTTPS for every page.

The other change in Chrome 56

The same release stops trusting certificates signed with the old SHA-1 algorithm. A site still using one now shows a full-page warning instead of the site.

Certificate authorities stopped issuing them for websites at the end of 2015, so most sites are fine. A certificate bought earlier, on a long term, is worth checking.

Your host or developer can tell you which algorithm signed your certificate in a minute.

A worked example

A well drilling company with three rigs works across a wide rural area, and its WordPress site has a page for each service, a gallery of finished wells and a quote form.

Years ago a developer added a login box to the footer for a planned customer area, where well owners would see their water test results. The area never launched. The box stayed.

Yesterday the office manager opened the site in the newly updated Chrome and found Not secure beside the address on every page, home page included.

The site had no HTTPS at all. The owner logs in to post photographs of new wells, often from motel Wi-Fi when the crews work out of town.

Every one of those logins had crossed the network as readable text.

The developer removed the dead login box that afternoon, which took the label off the public pages. The move of the whole site to HTTPS is booked for next week, and the owner has changed his password.

What moving the whole site involves

For a small site this is a modest job, and the certificate itself is often free now.

It needs a certificate that covers both forms of the address, with and without www, a permanent redirect from each old HTTP address to its secure match, and a sweep for images and scripts still loading over HTTP.

Then the site's own settings, Search Console and Analytics are updated to the new address. Done in that order, visitors and search engines barely notice the change.

The counter-case

Not every site shows the label to visitors this week.

A brochure site with no login boxes on its public pages, no shop and no member area shows nothing new to the public. Only the staff login page is flagged, and only staff see it.

Such a site can plan the move over a few weeks rather than this afternoon, as long as nobody logs in over public Wi-Fi in the meantime.

But the direction is clear, and the fix is the same for every site: HTTPS on every page, done once.

Before the next login

1. Open your site in the latest Chrome.
2. List every page with a password or card field.
3. Remove login boxes nobody uses.
4. Avoid logging in over public Wi-Fi meanwhile.
5. Check your certificate is not SHA-1.
6. Book the move of the whole site to HTTPS.
7. Change the passwords used on HTTP logins.

Step six is the real fix. Every other item on the list reduces the problem; moving every page to HTTPS removes it, and it covers whatever browsers flag next.

The passwords typed into those login pages, and who else knows them, are covered in passwords from the developer's handover email.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.