Skip to main content

Enforce HTTPS-Only Mode in Chrome

How to require users to use secure HTTPS connections in Chrome.

Written by Kavi Harshawat

Overview

When you visit a website, your browser connects to it using either HTTP or HTTPS. HTTPS encrypts the connection so that anything sent between your browser and the site — passwords, messages, form data — can't be read or tampered with by anyone in between. HTTP connections, by contrast, are unencrypted, meaning an attacker on the same network (like public Wi-Fi) could intercept or modify what's being sent.

HTTPS-Only Mode (also known as "Always use secure connections") forces Chrome to attempt loading every site over HTTPS and shows users a warning before visiting any site that doesn't support it. Enforcing this through the Admin console prevents users from accidentally sending sensitive information over insecure connections and reduces the risk of man-in-the-middle attacks.

Prerequisites

  • Administrator access to the Google Admin console

  • Users are running Chrome 112 or later

Instructions

  1. Sign in to the Google Admin console

  2. Navigate to Devices > Chrome > Settings > Users & browsers

  3. Select the organizational unit you want to apply this setting to

  4. Search for Allow HTTPS-Only Mode to be enabled

  5. Under Configuration, select Force enable HTTPS-Only Mode

  6. Click Save

Note: When HTTPS-Only Mode is force-enabled, users cannot turn it off. If your organization needs specific HTTP-only sites to remain accessible, use the HTTP Allowlist setting to exempt those hostnames from the policy.

Did this answer your question?