Chrome Tests HTTPS First Mode in Incognito

After introducing HTTPS-First Mode in Chrome, Google is now working to enforce HTTPS by default in Incognito mode across all platforms and devices. The company is currently testing this feature.

HTTPS First Mode enhances your browsing security. When enabled, it attempts to use HTTPS for every website you visit, if the website supports it. If not, Chrome will display a warning that the connection is not secure.

Google introduced HTTPS First Mode with Chrome 94 in September 2021. Recently, the company announced plans to expand HTTPS-First Mode protections to more people. It has enabled this feature for users enrolled in Google’s Advanced Protection Program who are also signed into Chrome.

Furthermore, Google plans to enable HTTPS First Mode by default in Incognito Mode. Chrome will enable this mode for sites that users typically access over HTTPS. The company is also exploring the possibility of automatically enabling HTTPS First Mode for users who rarely use HTTP.

Chrome tests HTTPS First Mode in Incognito

Google has started testing HTTPS First Mode in Incognito for Chrome. The respective flag is available. Activating it enables HTTPS First Mode in Settings and adds a possible “HTTPS First Mode in Incognito” option in Settings.

Chrome is aiming to enable HTTPS First Mode in Incognito windows by default. However, users will have control over this feature in chrome://settings/security to change this. Users can also disable HTTPS First Mode entirely if they wish.

Google is updating the HTTPSFirstMode Service to track the new Incognito preference. When the flag is enabled, the service tracks it in three states. This could mean tracking when the feature is off, turned on for all websites, or turned on only for Incognito mode.

When you enable HTTPS-First Mode in Incognito flag, you’ll notice three new security settings in Chrome

1. See warnings before going to insecure sites (recommended): If this setting is enabled, Chrome will warn you before loading any site that uses an insecure connection. This is the recommended setting for most users.

2. See warnings before going to insecure sites in Incognito mode: If this setting is enabled, Chrome will warn you before loading a site using an insecure connection even when you’re browsing in Incognito mode.

3.Don’t see any warnings before going to insecure sites: If this setting is enabled, Chrome will use an insecure connection without warning you when HTTPS isn’t available.

HTTPS First Mode protection in Incognito mode works similarly to normal mode for all websites. If Chrome fails to retrieve the HTTPS version of a site in Incognito, it shows an HTTP interstitial warning that the site is not secure, as stated in a Chromium bug.

“When the feature flag and preference are enabled, HTTPS-First Mode is enforced in Incognito windows, showing the HTTP interstitial when a fallback to HTTP occurs.”

What’s your take on Chrome improving Security in Incognito Mode? Let us know your throughts in the comments below.