43

Many websites offer both, HTTP and HTTPS, e.g., http://stackoverflow.com and https://stackoverflow.com

Is there any way to force Chrome to try HTTPS first before HTTP when I only type stackoverflow.com in the address bar?

  • 5
    note, some sites produce different content with different protocols. – 把友情留在无盐 May 12 '15 at 0:09
  • 2
    It will not add much security because an attacker can trigger a fallback to http quite easily. If you really want the additional security, the browser has to remember which domains previously worked over https and not automatically fall back to http on sites where https worked in the past. (That would not be a strict as HSTS, because you can still manually type http:// and use http: links.) – kasperd May 12 '15 at 10:59
  • @soubunmei I'm curious. Have you got any examples of that? – paradroid May 13 '15 at 0:43
  • @paradroid it is theoretically possible, however I'd be surprised if anyone did that in practice (see you can add a port to your vhost configuration) - httpd.apache.org/docs/2.2/mod/core.html#virtualhost – Shane May 13 '15 at 6:14
52

You could try this HTTPS Everywhere Chrome extension.

  • 1
    This seems to be the extension with more users and open source code. Giving it a try. – kiewic May 11 '15 at 21:32
  • 2
    This was exactly the first thing that popped in my mind when I read this title. But keep in mind that it may break some stuff. If it requests a page with HTTPS and it works, but for some weird reason it can't use HTTP to connect to a page using XHR, then you will be left with a buggy page. – Ismael Miguel May 12 '15 at 8:49
  • 2
    @IsmaelMiguel that's probably a good disclaimer for any extension that hardens your browser; increased security usually comes at the expense of some usability. IMO "block-by-default" with the option to enable if you feel safe is much better than the alternative, but does require some end-user awareness. – Mike Ounsworth May 12 '15 at 16:08
  • 2
    @MikeOunsworth Such awareness is almost near null for most users. Most only read "increased safety and privacy" and jump right into using it. Then they blame the extension for this. But still, it should be a good idea to add it here. I know that Tor has some troubles with StackExchange. – Ismael Miguel May 12 '15 at 16:22
29

Force HTTPS in Chrome

Google is one of the more aggressive companies pushing to make this happen. Here are several ways you can force HTTPS in Chrome to ensure your browsing is as safe as possible.

Startup Chrome with HTTPS

Chrome support typing chrome://net-internals/ into your address bar, and then include HSTS menu item. HSTS is HTTPS Strict Transport Security: a way for sites to elect to always use HTTPS. HSTS is supported in Google Chrome, Using this setting you can now force HTTPS for any domain you want, and even “pin” that domain so that only a more trusted subset of CAs are permitted to identify that domain. The downside is that if you force a domain that does not have SSL at all you won’t be able to get to the site.

Chromium.org

Force HTTPS with KB SSL Enforcer extension

This extension will force HTTPS in Chrome for websites that support, It is not completely secure against the infamous Firesheep, but it does minimize the risk greatly. Due to Chrome limitations KB SSL Enforcer redirects the page while it is loading. You get a quick flicker of the unencrypted page, but it redirects you as fast as possible.

KB SSL Enforcer

HTTP extension to Force HTTPS in Chrome

Use HTTP will forces defined sites to use HTTPS instead of HTTP. It comes preloaded with two defined sites: Facebook and Twitter. Like the previous extension the initial request is sent to site not using HTTPS.

Use HTTPS

  • 1
    Note that the presence of HSTS is determined by the server operator, not the client. – a CVn May 12 '15 at 11:09
  • 4
    @MichaelKjörling Actually, it partly depends on the client, since they can have pre-loaded lists (as explained in the Chromium link in the answer). – Bruno May 13 '15 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.