Why Chrome Warns About or Blocks Insecure Downloads

Chrome warns about or blocks some downloads delivered over an unencrypted HTTP connection because a network attacker could replace the file in transit. This protection is no longer a proposed Chrome 111 experiment: mixed-content download restrictions and broader insecure-download warnings are part of current Chrome security behavior.

What counts as an insecure download?

An insecure download is a file transferred over plain HTTP rather than HTTPS. A common case is a secure HTTPS page whose download button redirects to an HTTP file server. This is called a mixed-content download.

HTTPS encrypts and authenticates the connection between the browser and server. It does not prove that the site or file is trustworthy, but it makes undetected tampering in transit much harder. HTTP provides no comparable transport protection.

What Chrome does today

Chrome's response depends on the page, the final download URL, the file type, Safe Browsing results, and security settings:

• Mixed-content downloads: Chrome began phasing in restrictions in 2020 and announced complete blocking for mixed-content downloads from Chrome 88 onward.
• High-risk files over HTTP: Chrome can warn before downloading executables, archives, and other files that could harm the device.
• Safe Browsing detections: A file may be blocked as dangerous, suspicious, uncommon, or unverified even when it was delivered over HTTPS.
• HTTPS-First protection: When Always use secure connections is enabled, Chrome tries HTTPS first and warns before opening a site that cannot use it.

Google's current help page explains the labels Chrome uses for blocked and warned-about downloads. A warning is evidence to investigate, not a prompt to find a different browser that will download the same file without checking it.

Turn on Always use secure connections

1. Open Chrome and select More > Settings.
2. Choose Privacy and security > Security.
3. Under Secure connections, enable Always use secure connections.
4. Choose whether Chrome should warn only for insecure public sites or also for private sites such as an intranet, if the option is shown.

Chrome will attempt to upgrade HTTP URLs to HTTPS and display a warning when a site does not support a secure connection. Google documents the current controls in Manage Chrome safety and security.

The old “block insecure downloads” flag

The screenshot below comes from the feature's development period, when it could be tested through chrome://flags. Chrome flags are experimental, may disappear, and are not a dependable way to manage production security. Use the normal Security settings and keep Chrome updated instead.

The original Chromium announcement described the later expansion beyond mixed downloads. The project history is available in Towards HTTPS by default.

What to do when Chrome blocks a file

1. Stop and check the source. Confirm that the domain belongs to the software publisher or organization you intended to use.
2. Look for an HTTPS version. Return to the official download page instead of changing http:// manually on an unknown mirror.
3. Check the redirect. A secure-looking page can still send the file from a different insecure host.
4. Verify the file. Compare a publisher-provided checksum or digital signature when available. Scan the file with the operating system's security software before opening it.
5. Ask the publisher. If the official site only offers HTTP, request a secure download or another verified distribution channel.

TipsMake's overview of safer Windows software sources explains why the developer's site or an official app store is usually preferable to a repackaging site.

Should you override the warning?

Only consider keeping an insecure download when you know exactly what the file is, have verified it through an independent trusted channel, and understand that HTTP allowed possible modification in transit. A familiar filename, an HTTPS landing page, or an antivirus scan alone is not proof that the file is safe.

Do not disable Safe Browsing globally or allow insecure content for every site just to retrieve one file. Those changes weaken protection for unrelated browsing. On a managed work or school device, the block may be enforced by policy; contact the administrator instead of trying to bypass it.

For website owners: fix the download chain

• Serve the page and the file itself over HTTPS.
• Update every redirect in the chain so none falls back to HTTP.
• Use HTTPS for CDN, object-storage, and mirror URLs.
• Replace hard-coded HTTP links in templates, databases, and older posts.
• Test while signed out and from a clean browser profile; cached redirects can hide a problem.
• Publish checksums or signed packages for security-sensitive software.

Chrome's earlier rollout plan for mixed downloads is documented in Protecting users from insecure downloads. Site owners should not rely on visitors overriding the warning.

HTTP warning versus a certificate error

An HTTP warning means the connection is not encrypted. A “Your connection is not private” page usually means Chrome attempted HTTPS but could not validate the site's certificate. The causes and appropriate fixes differ; see the TipsMake guide to Chrome certificate errors for that case.

Also remember that HTTPS only secures transport. Phishing sites and malicious downloads can use valid HTTPS certificates, so check the publisher, URL, file signature, and security scan as well.