Google has began sending out notices through the Google Search Console to websites that have login and password fields on pages that aren’t over HTTPS. The notification says that nonsecure Collection of Passwords will trigger warnings in Chrome 56 for domain.com.
In January, Chrome 56 is going to issue a security warning for web pages that have these login fields without serving them on a page that is over HTTPS. Here’s how the message reads:
Beginning in January 2017, Chrome (version 56 and later) will mark pages that collect passwords or credit card details as “Not Secure” unless the pages are served over HTTPS.
The following URLs include input fields for passwords or credit card details that will trigger the new Chrome warning. Review these examples to see where these warnings will appear, and so you can take action to help protect users’ data. The list is not exhaustive.
It was also posted by Google on Google+ where this was written:
From the end of January with Chrome 56, Chrome will mark HTTP sites that collect passwords or credit cards as non-secure. Enabling HTTPS on your whole site is important, but if your site collects passwords, payment info, or any other personal information, it’s critical to use HTTPS. Without HTTPS, bad actors can steal this confidential data. #NoHacked
For a while now, Google has been pushing sites to go HTTPS. They’ve even been giving a ranking boost to pages with HTTPS URLs.
Here is a copy of the notification:
