43

Many websites offer both, HTTP and HTTPS, e.g., http://stackoverflow.com and https://stackoverflow.com

Is there any way to force Chrome to try HTTPS first before HTTP when I only type stackoverflow.com in the address bar?

Improve this question
5
  • 5
    note, some sites produce different content with different protocols.
    – 把友情留在无盐
    Commented May 12, 2015 at 0:09
  • 2
    It will not add much security because an attacker can trigger a fallback to http quite easily. If you really want the additional security, the browser has to remember which domains previously worked over https and not automatically fall back to http on sites where https worked in the past. (That would not be a strict as HSTS, because you can still manually type http:// and use http: links.)
    – kasperd
    Commented May 12, 2015 at 10:59
  • @soubunmei I'm curious. Have you got any examples of that?
    – paradroid
    Commented May 13, 2015 at 0:43
  • @paradroid it is theoretically possible, however I'd be surprised if anyone did that in practice (see you can add a port to your vhost configuration) - httpd.apache.org/docs/2.2/mod/core.html#virtualhost
    – Shane
    Commented May 13, 2015 at 6:14
  • As of May 2021, Chrome defaults to trying https:// first: blog.chromium.org/2021/03/…
    – Venryx
    Commented Aug 30, 2021 at 13:03

4 Answers 4

Reset to default
52

You could try this HTTPS Everywhere Chrome extension.

Improve this answer
4
  • 1
    This seems to be the extension with more users and open source code. Giving it a try.
    – kiewic
    Commented May 11, 2015 at 21:32
  • 2
    This was exactly the first thing that popped in my mind when I read this title. But keep in mind that it may break some stuff. If it requests a page with HTTPS and it works, but for some weird reason it can't use HTTP to connect to a page using XHR, then you will be left with a buggy page.
    – Ismael Miguel
    Commented May 12, 2015 at 8:49
  • 2
    @IsmaelMiguel that's probably a good disclaimer for any extension that hardens your browser; increased security usually comes at the expense of some usability. IMO "block-by-default" with the option to enable if you feel safe is much better than the alternative, but does require some end-user awareness.
    – Mike Ounsworth
    Commented May 12, 2015 at 16:08
  • 2
    @MikeOunsworth Such awareness is almost near null for most users. Most only read "increased safety and privacy" and jump right into using it. Then they blame the extension for this. But still, it should be a good idea to add it here. I know that Tor has some troubles with StackExchange.
    – Ismael Miguel
    Commented May 12, 2015 at 16:22
30

Force HTTPS in Chrome

Google is one of the more aggressive companies pushing to make this happen. Here are several ways you can force HTTPS in Chrome to ensure your browsing is as safe as possible.

Startup Chrome with HTTPS

Chrome support typing chrome://net-internals/ into your address bar, and then include HSTS menu item. HSTS is HTTPS Strict Transport Security: a way for sites to elect to always use HTTPS. HSTS is supported in Google Chrome, Using this setting you can now force HTTPS for any domain you want, and even “pin” that domain so that only a more trusted subset of CAs are permitted to identify that domain. The downside is that if you force a domain that does not have SSL at all you won’t be able to get to the site.

Chromium.org

Force HTTPS with KB SSL Enforcer extension

This extension will force HTTPS in Chrome for websites that support, It is not completely secure against the infamous Firesheep, but it does minimize the risk greatly. Due to Chrome limitations KB SSL Enforcer redirects the page while it is loading. You get a quick flicker of the unencrypted page, but it redirects you as fast as possible.

KB SSL Enforcer

HTTP extension to Force HTTPS in Chrome

Use HTTP will forces defined sites to use HTTPS instead of HTTP. It comes preloaded with two defined sites: Facebook and Twitter. Like the previous extension the initial request is sent to site not using HTTPS.

Use HTTPS

Improve this answer
3
  • 1
    Note that the presence of HSTS is determined by the server operator, not the client.
    – user
    Commented May 12, 2015 at 11:09
  • 4
    @MichaelKjörling Actually, it partly depends on the client, since they can have pre-loaded lists (as explained in the Chromium link in the answer).
    – Bruno
    Commented May 13, 2015 at 14:39
  • 1
    Answer was valid in 2015 - since Chrome 94 (Sept 2021) "https first" mode can be enabled as a default setting in the menu, no extensions required. As of Chrome 98 (Feb 2022) it's still not the default though.
    – mr.spuratic
    Commented Feb 23, 2022 at 9:36
1

The HTTPS Everywhere Chrome extension will sunset in January 2023, but for a good reason: always using HTTPS has been added as an option to most modern browsers, among which to Chrome!

The setting is currently located in Settings > Privacy and security > Security > Always use secure connections. Enabling the checkbox will attempt to use HTTPS for every site, and warn the user if a site does not support HTTPS. This is exactly what the extension(s) did as well.

Improve this answer
0
0

Chrome now has this built-in. Settings, Privacy and Security, Advanced, "Always use secure connections"

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .