HTTPS pages commonly suffer from a problem called mixed content, where subresources on the page are loaded insecurely over Browsers block many types of mixed content by default, like scripts and iframes, but images, audio, and video are still allowed to load, which threatens users’ privacy and security. We’re now turning our attention to making sure that HTTPS configurations across the web are secure and up-to-date. In the past several years, the web has made great progress in transitioning to HTTPS: Chrome users now spend over 90% of their browsing time on HTTPS on all major platforms. This change will improve user privacy and security on the web, and present a clearer browser security UX to users. In a series of steps outlined below, we’ll start blocking mixed content (insecure subresources on pages) by default. Today we’re announcing that Chrome will gradually start ensuring that pages can only load secure subresources. Check the Chrome Platform Status entry for the latest information about when mixed images will be autoupgraded and blocked if they fail to load over Sites with mixed images will continue to trigger the “Not Secure” warning. Update (April 6, 2020): Mixed image autoupgrading was originally scheduled for Chrome 81, but will be delayed until at least Chrome 84.

Least insecure browser