Chrome now distinguishes suspicious sites from known dangerous ones. Its new suspicious-site warning is a softer alert for pages that look like scam or phishing sites but are not confirmed as malicious. The familiar full-page red screen remains for sites Google is confident are dangerous. You need Safe Browsing’s Enhanced protection to see the new warning. That mode also adds cloud-based Gemini scam checks and a defence against ClickFix copy-and-paste attacks.
Separately, Chrome now asks for permission before it opens most public sites over plain HTTP, and that one is on by default for everyone. Google announced both changes on 20 and 21 October.
What a suspicious site warning looks like
In Google’s screenshots, a red “Suspicious” chip appears at the left of the address bar and a pop-up says “This site doesn’t seem right”, explaining that the site seems similar to others associated with phishing, malware and scams. The page stays visible but darkened behind it. You get two buttons: Back to safety and Mark as safe. On Android, the same message appears as a card over the page.
Google’s example is a fake parcel page demanding an “Outstanding Clearance Fee” before a delivery is released. That is a good choice, because fake courier and customs fee pages are exactly the kind of link that arrives by SMS or WhatsApp and looks plausible on a phone screen.
Suspicious vs dangerous: what each warning means
Google borrowed this two-tier idea from Chrome’s download warnings, which already separate suspicious files from dangerous ones. The difference is how sure Safe Browsing is:
| Suspicious site | Dangerous site | |
|---|---|---|
| Confidence | Lower confidence verdict, possible risk of harm | High confidence verdict, high risk of harm |
| Why it appears | The page shows deceptive patterns common on known malicious sites | The page is known to be malicious |
| What you see | Pop-up over a dimmed page, “Suspicious” chip in the address bar | Full-page red warning that replaces the site |
| Who gets it | Enhanced protection users | Safe Browsing users, as before |
Because the softer warning is less disruptive, Google says it can show far more of them. You may see it on pages that never triggered a warning before, and because the verdict is lower confidence, a legitimate site could be flagged. That is what Mark as safe is for. Use it only when you know the site, such as your own bank’s real domain that you typed in yourself, not because a page told you to ignore the warning.
Gemini scam detection now runs on Google’s servers
Last year Chrome started using an on-device Gemini model to spot tech support scams, but only for Enhanced protection users on devices that could run it. Google has now moved that check to a more powerful server-side Gemini model. Two things change: every Enhanced protection user gets it, regardless of device, and it covers more scam types, including fake antivirus pages and fake browser update pages.
Gemini looks at the page and judges which brand it is pretending to be, what it wants you to do and how likely it is to be a scam. Safe Browsing combines that with domain reputation and other security signals before deciding whether to warn you. Chrome’s web-page checks are separate from Google’s scam detection in Messages.
Sending page content to Google is the obvious privacy question. Google says Chrome only sends page text when a site already shows high-confidence scam signs, and that anything sent off the device is processed ephemerally, which it defines as never logged, retained or used to train models.
How Chrome now spots ClickFix scams
ClickFix is a nasty trick because you do the dangerous part yourself. A page shows a fake error, such as a failed browser update, and tells you to copy a “fix” command and paste it into the Windows Run box or a terminal. The command you paste is often not the one shown on screen. It usually calls built-in tools such as PowerShell or cmd.exe, which security software trusts, and because the malware download happens in the terminal rather than the browser, Chrome’s normal download protection never sees it.
Chrome now notices when an Enhanced protection user copies what looks like a ClickFix command. It strips personal information from the copied text, sends it to Safe Browsing for analysis and shows a warning if the verdict comes back dangerous. Google says it aims to minimize false alarms when developers copy ordinary commands from documentation.
The rule that protects you even without this feature is simple: no real website, and never Chrome itself, needs you to paste a command into your computer to view a page or install an update.
Chrome now asks before opening HTTP sites
This change does not need Enhanced protection. Chrome now shows “This site doesn’t support a secure connection” before it loads a page over unencrypted HTTP, with Continue to site and Go back buttons. Enhanced protection users got it earlier this year, and Google has now turned it on by default for all users.
The old “Not Secure” label only appeared after your data had already gone over the connection, and it never showed on quick HTTP redirects at all. The prompt fixes that by asking first. A few details keep it from getting annoying:
- You approve a site once, and Chrome does not warn again unless you have not visited it for at least two weeks.
- Local addresses such as 192.168.0.1 and single-word hostnames such as intranet/ are not flagged by default, so your Wi-Fi router’s settings page still opens normally.
- Google says nearly 95% of desktop users see no HTTP warning in a given week, and under 1% see three or more.
If you do see the prompt, the warning text gives the right advice: avoid sending anything sensitive on public Wi-Fi, and treat a login or payment page on HTTP as a red flag.
How to turn on Enhanced protection in Chrome
Chrome uses Standard protection by default, so most people will not see the new suspicious site warnings, Gemini checks or ClickFix alerts until they switch.
On a Windows PC, Mac or Chromebook:
- Open Chrome and select the three-dot menu at the top right, then Settings.
- Select Privacy and security, then Security.
- Under Safe Browsing, choose Enhanced protection.
You can also type chrome://settings/security into the address bar to jump straight there.
On Android: open Chrome, tap the three-dot menu, then go to Settings > Privacy and security > Safe Browsing and choose Enhanced protection.
Google also suggests turning on Enhanced Safe Browsing for your Google Account, which extends the protection to Gmail and other Google services when you are signed in. On a work or school device, an admin may control this setting.
Is Enhanced protection worth the trade-off?
The trade-off is real. With Enhanced protection, Chrome sends Google the URLs you visit and small samples of page content, extension activity and system information to check them in real time. Standard protection hides your IP address and only sends full URLs when a site behaves suspiciously. Google says Enhanced protection data is used only for security and does not noticeably slow down browsing.
Google claims Enhanced protection users are ten times safer than Standard users. Its footnote says the figure compares the number of warnings shown to each group, not how many scams users avoided. Treat it as a measure of warnings, not proof of a tenfold reduction in harm.
My take: Enhanced protection is worth considering if you or someone in your family is likely to tap a fake delivery link or follow a “fix your browser” prompt. But it sends more browsing information to Google than Standard protection. If that trade-off does not suit you, Standard protection plus the new HTTP prompt remains a reasonable baseline, though you will not get the suspicious site warnings.
