Secure connections

Settings → Privacy and security → Secure connections controls how pages that ask for plain HTTP are loaded, and how site names are looked up. Both settings apply to every window, incognito too, and take effect straight away.

HTTPS

In Upgrade when possible, a site that has no working HTTPS falls back to HTTP without an error page, and the Browser remembers that until you quit, so it doesn't try again on every page.

When the page you're on fell back to plain HTTP, or loaded over HTTP because you allowed the site, the titlebar shows Not secure before its title.

What's never upgraded

Addresses on your own computer or network stay as they are: localhost, local network and private IP addresses, names ending in .local, .internal, .test, .lan or .home.arpa, single-word names like router, and addresses with a port other than 80. Forms sent over HTTP aren't upgraded either.

The HTTPS-only warning

In HTTPS only, a site that can't load securely shows This site doesn't support a secure connection instead of the page.

• Go back is picked, so Enter takes you back.
• Continue to site loads it over HTTP and stops warning for that site. Press Tab then Enter to choose it from the keyboard.
• Reloading the warning tries HTTPS again.

Sites you've continued to are listed under Settings → Privacy and security → Sites allowed over HTTP. Each entry covers the site's subdomains. Warn again removes one, Add a site adds one by address, and Remove all clears the list. Sites you continue to in an incognito window are kept only until incognito closes.

Secure DNS

Before a page loads, its name (like example.com) is looked up to find the server's address. Normally that lookup goes to your network's DNS provider unencrypted, so anyone on the network can see which sites you visit. Secure DNS sends it encrypted, over HTTPS.

With a provider picked, Fall back to system DNS decides what happens when that provider can't be reached:

• On: your network's DNS answers instead.
• Off: sites don't load until the provider is back. This is stricter, but on a hotel or airport network that blocks encrypted DNS, nothing loads until you change the setting.

A change applies to the next page you load. Connections already open stay open until they close.

With a VPN or proxy

A VPN extension or proxy looks names up itself, so secure DNS doesn't apply to traffic that goes through it. See VPN extensions.