Starting in 2017 and expanding through 2018, Chrome began progressively labeling plain HTTP pages as "Not Secure" — first only on pages with password or credit card fields, then on any page in Incognito mode, and eventually on all HTTP pages regardless of content.
Why the rollout was gradual
Google deliberately staged the change over roughly two years rather than flipping it all at once, giving site owners time to migrate and avoiding an abrupt, disruptive change across the entire web — while still creating steadily increasing pressure toward HTTPS adoption at each stage.
The measurable effect
This rollout is widely credited as one of the single largest drivers of HTTPS adoption across the web, working in tandem with Let's Encrypt's free certificates — the technical barrier to HTTPS had already been mostly removed by the time the visible browser pressure to actually use it arrived.
The specific staged rollout timeline in more detail
Chrome's phased approach began in January 2017 by flagging HTTP pages with password or credit card fields specifically, expanded in October 2017 to flag any HTTP page when the user started typing into a form field or when in Incognito mode, and reached its broadest point in July 2018 when Chrome began marking every HTTP page as Not Secure regardless of content — a roughly eighteen-month escalation that gave the industry clear, predictable advance notice at each stage.
How other browsers responded in parallel
Firefox introduced broadly similar warnings around the same period, generally following Chrome's lead in timing though with some differences in exact visual treatment and triggering conditions — this loose, competitive-but-parallel coordination across major browser vendors, each independently reaching similar conclusions, has been a recurring pattern throughout HTTPS adoption history rather than something coordinated through a single standards body.
How Chrome measured and reported on the rollout's actual effect
Google periodically published its own internal metrics during and after the rollout showing measurable increases in HTTPS adoption correlating with each escalation stage, using this data both to justify continuing the phased approach and as a public accountability mechanism demonstrating the initiative was achieving its stated goal rather than just imposing friction without benefit.
What the warning actually looks like today, and how it's evolved
The specific visual treatment of the warning has itself evolved since the initial 2017-2018 rollout — Chrome has periodically refined the wording, iconography, and exact triggering conditions in smaller updates since the major rollout period, reflecting ongoing usability refinement rather than a single, permanently fixed design decided once in 2018.
What site owners specifically needed to check before each escalation
At each stage of the rollout, site owners running any form on an HTTP page, or any HTTP page at all by the final stage, needed to confirm their migration to HTTPS was complete and correctly configured well ahead of each announced deadline, since Chrome gave advance notice specifically to allow this kind of proactive preparation rather than surprising site owners with an unannounced change.
How this rollout is studied as a model for other browser security UX changes
Chrome's staged, publicly telegraphed approach to the Not Secure rollout has since been referenced as a template for other significant browser security UX changes, including aspects of how the EV certificate UI removal and various cookie-security changes were subsequently communicated and rolled out — a reusable playbook for introducing user-facing security changes gradually enough to avoid mass disruption while still achieving the underlying security goal.
What this specific initiative demonstrates about consumer-facing security communication
Chrome's rollout demonstrated that consumer-facing security messaging can meaningfully shift widespread technical behavior at internet scale when the messaging is clear, consistently applied, and paired with adequate advance notice — a template referenced well beyond browser security in broader discussions about how to communicate technical risk to non-specialist audiences effectively.
Few browser UI decisions have had as measurable an effect on real-world security adoption as this specific, carefully staged rollout.