How to Secure Chrome Browser: A Complete Settings Checklist

“Secure Chrome browser” gets searched a lot, and for good reason: Chrome has more security settings than most people ever open, tucked a few menus deep under Privacy and security. Most are off, on a default middle setting, or simply unfamiliar, which means the browser you use every day is probably running with less protection than it could.

This guide walks through the settings that actually matter — Safe Browsing levels, Safety Check, HTTPS enforcement, site permissions, updates, and password security — in the order I’d check them. It also covers Chromebook-specific security and the one thing none of these settings protect: the forty tabs you had open when something went wrong. That’s a different problem, and it has a different fix.

How Do I Secure My Chrome Browser?

You secure Chrome browser by working through a short list of settings under Privacy and security, most of which take under a minute each to check or change. There’s no single “secure mode” switch. It’s a combination of Safe Browsing, HTTPS enforcement, permission review, and staying updated.

Here’s the checklist in the order it’s worth doing it, before the detailed walkthrough of each one below.

Start with Safe Browsing. If you only change one setting today, make it Enhanced Safe Browsing. It’s the broadest protection on this list and covers sites, downloads, and extensions at once.

What Is Chrome Safe Browsing, and Which Protection Level Should I Use?

Chrome Safe Browsing has three levels (Enhanced protection, Standard protection, and No protection) set under Settings, Privacy and security, Security Safe Browsing help. Standard is the default, and No protection is explicitly flagged by Google as “not recommended.”

Enhanced protection is described as “Google’s most secure browsing experience,” offering security from known and potential new dangers. It works by sending the visited URL, a small sample of page content, extension activity, and system information to Google Safe Browsing (including scans of suspicious downloads) used “only for security purposes.” It also warns about breached passwords and, per Google, “doesn’t noticeably slow down your browser or device” Safe Browsing help.

Standard protection takes a more privacy-conscious middle path. It warns about already-identified dangerous sites, downloads, and extensions, and sends only an obfuscated portion of the URL through privacy servers, structured so that “neither Google nor the third-party operating the privacy server can see both the URL you’re visiting and your IP address.” Full URLs or page content are only sent if a site starts behaving suspiciously Safe Browsing help.

Which level to pick usually comes down to how much you trust Google with slightly more browsing data in exchange for stronger warnings. Enhanced protection shares more with Google’s Safe Browsing systems, including extension activity and system information, but it reacts to new threats rather than only known ones. Standard protection shares less by design, keeping URLs obfuscated so no single party sees both the site and your IP address together. If you’re on a work laptop, a shared family computer, or you just click links from unfamiliar sources often, Enhanced is worth the small privacy trade-off. If you’re already careful about what you click and prefer to share less, Standard is a reasonable default rather than a weak one.

How Do I Turn On Chrome’s Safety Check?

Chrome’s Safety Check runs automatically in the background, but you can also trigger it manually from Settings, Privacy and security, Safety Check, then “Go to Safety Check” Safety Check help. It’s the closest thing Chrome has to a one-click security audit.

A single run checks for compromised, reused, or weak passwords using Google Password Manager’s breach data, your current Safe Browsing status, whether a Chrome update is available, unwanted or abusive notification permissions, unused site permissions (which Chrome can auto-remove), and potentially harmful extensions Safety Check help.

That’s six different checks bundled into one button, which makes it worth running any time something about Chrome feels off — new pop-ups, an extension you don’t remember installing, or a password you suspect might be old and reused. Running it manually doesn’t replace the automatic background pass; it just gives you the results on demand instead of waiting.

1. Open Chrome’s menu. Click the three dots at the top right, then Settings.
2. Go to Privacy and security. Scroll to the Safety Check section.
3. Click “Go to Safety Check.” Chrome runs all six checks in one pass.
4. Work through the results. Fix compromised passwords, remove harmful extensions, or update Chrome as prompted.

Run it after installing anything new. Extensions and permission grants are two of Safety Check’s categories. A quick manual run after adding a new extension catches problems before they sit unnoticed for months.

Running Safety Check takes less time than reading about what it checks. That’s really the point of it: Google bundled six separate audits — passwords, Safe Browsing status, updates, notification permissions, unused site permissions, and extensions — into one button precisely because most people never go looking for these problems on their own. Nobody wakes up thinking “let me go check my extension list for anything malicious.” Safety Check surfaces it anyway.

If Safety Check flags weak or reused passwords, that leads directly into Google Password Manager, covered in more detail in the password section below — or in our full guide to the Chrome password manager.

How Do I Make Chrome Always Use Secure (HTTPS) Connections?

You turn on HTTPS enforcement under Settings, Privacy and security, Security, Secure connections, then “Always use secure connections.” Once enabled, “Chrome upgrades URLs to use HTTPS and displays a warning before you visit a site that doesn’t support it” HTTPS settings help.

You get a choice of scope when you turn it on: warnings for insecure public sites only, or for both public and private sites. After that, any site without HTTPS shows a “Not Secure” warning right in the address bar, which makes it obvious before you type in a password or payment details.

This setting pairs with another one nearby worth turning on at the same time: “Warn you if a password was compromised in a data breach,” found under the same Security > Advanced section HTTPS settings help. It’s also worth knowing that Secure DNS runs in automatic mode by default, encrypting lookups when a site supports it and only falling back to unencrypted DNS if there’s a problem — unless you’ve set a custom DNS provider yourself.

Between HTTPS enforcement and the breach-password warning, these two toggles cover a surprising amount of ground for how quickly they take to turn on. Neither requires ongoing maintenance once set.

It’s worth understanding what this setting protects against, since “HTTPS” can sound like abstract technical plumbing. An unencrypted HTTP connection means anything you type or that a site sends back (including passwords, if a site is still badly configured enough to ask for one over HTTP) can potentially be read by anyone sharing the same network, like on public Wi-Fi at a coffee shop or airport. HTTPS encrypts the connection between your browser and the site. Chrome upgrading URLs automatically means you’re less likely to land on an insecure version of a site by accident, even if you typed the address without “https://” in front of it.

How Do I Check and Fix Chrome Site Permissions?

You check Chrome site permissions under Settings, Privacy and security, Site permissions, which lists every site’s access to things like location, cookies, pop-ups, camera, microphone, and autoplay Site permissions help. It’s the setting most people never open, and it’s often where old, forgotten grants pile up.

Think about how many sites you’ve clicked “Allow” on over the years for location or notifications, usually without much thought at the time. Site permissions is where all of those live, sorted by permission type rather than by site, which makes it easy to scan for anything that shouldn’t still have access.

A few permissions are worth specifically checking rather than leaving on “whatever I clicked years ago”:

Safety Check, covered above, partially automates this by flagging and offering to remove unused permissions on its own Safety Check help. But a manual pass through Site permissions catches things Safety Check might not flag as “unused” yet, especially sites you granted access to recently but no longer trust.

Going through this list once, start to finish, usually takes a few minutes and turns up at least one permission you forgot you’d granted. It’s not a glamorous task, but it’s one of the few security checks here that’s entirely in your hands rather than something Chrome does for you automatically.

How Do I Make Sure Chrome Is Up to Date?

You check for Chrome updates via the Chrome menu, then Help, then About Google Chrome, which checks for updates as soon as the page loads Update help. A “Relaunch” button appears if an update is ready to install; if you don’t see one, Google’s own guidance is direct — “you’re on the latest version.”

Updates matter more for security than almost anything else on this list, since they patch the vulnerabilities attackers actively look for. The relaunch process is quick: your tabs and windows reopen automatically afterward, though Google notes one exception worth knowing — “Your Incognito windows won’t reopen when Chrome restarts” Update help. If you’re not ready to restart, “Not now” simply defers the update to the next time Chrome closes.

Update behavior differs slightly by platform. On Mac, updating for all users is handled from the same About Google Chrome page. On Windows, the update applies on relaunch after all windows are closed. On Linux, updates come through your package manager instead of Chrome itself. On a Chromebook, you update Chrome by updating ChromeOS as a whole Update help.

Of everything on this list, staying updated is probably the setting most people skip without realizing it. There’s no flashy toggle to switch, just a page to open every so often to confirm you’re current. That’s exactly why it’s worth building into a routine — check it the same time you run Safety Check, since you’re already in the Chrome menu anyway.

Regular tabs survive a Chrome update. Google confirms tabs and windows reopen automatically after an update relaunch. It’s specifically Incognito windows that don’t come back. Still, for anything you can’t afford to lose, a saved session is safer than relying on relaunch behavior alone.

How Do I Secure My Google Password Manager in Chrome?

You secure Google Password Manager by opening it from Chrome’s menu under Passwords and autofill, then running a Checkup to scan all your saved passwords for breach exposure or weakness Password Manager help. It’s also reachable directly at passwords.google.com from any browser.

Inside, you can choose whether passwords save to your Google Account for cross-device access, save locally to just this device, or import device-saved passwords into your account instead Password Manager help. The Checkup tab is the security-focused part. It checks all your saved passwords at once to find out if they’re exposed in a data breach or potentially weak, and it handles passkeys alongside passwords, including deleting both together when needed.

For an extra layer, on-device encryption lets you open your saved passwords with your Google password or your device’s screen lock — Google describes it as meaning only you hold the key that opens them HTTPS settings help. Biometric fill is available too — “Use Windows Hello when filling passwords” on Windows, or “Use your screen lock when filling passwords” on Mac Password Manager help.

How Do I Stop Chrome From Opening New Tabs or Ads by Itself?

You stop Chrome from opening new tabs or ads on its own by running Google’s cleanup steps in order: remove unwanted ads, pop-ups, and malware; check Site Settings for pop-up and intrusive-ad permissions; run Safety Check to review extensions and permissions; and, as a last resort, reset Chrome’s settings to their original defaults Unwanted ads help.

This behavior is almost always caused by one of two things: a site you granted pop-up permission to at some point, or an extension doing something you didn’t intend. Safety Check, covered earlier, is genuinely useful here because it flags potentially harmful extensions specifically, which is the category most likely to be the actual cause.

If those steps don’t fix it, the reset option is blunt but effective. It restores Chrome’s settings to their original defaults, clearing out misconfigured permissions and disabling extensions in one move Unwanted ads help. It’s worth trying the lighter steps first, since a full reset also clears customizations you might want to keep, like your homepage or startup page setup. For a deeper look at this specific issue, see our guide on Chrome opening new tabs by itself, and for managing the extensions themselves, how to manage Chrome extensions.

Is Chrome Secure on a Chromebook?

Chrome on a Chromebook uses the same Privacy and security settings covered above, plus a few protections that exist at the ChromeOS level rather than inside the browser itself. Guest browsing is the main one (accessible under People or “Manage other people” in Chromebook settings) which runs a session that doesn’t save activity to the device the way regular Chrome’s Guest mode does on desktop Chromebook Guest browsing help.

If you landed here searching for an “AIR secure browser” or a “secure browser on Chromebook” for a standardized test, that’s a different category of software entirely — a locked-down kiosk application schools install specifically for exam sessions, separate from Chrome’s own settings. This guide is about securing the everyday Chrome browser you use for regular browsing, not exam lockdown tools, so treat that as a distinct topic if that’s what brought you here.

For day-to-day Chromebook security, the same checklist applies: Enhanced Safe Browsing, Safety Check, HTTPS enforcement, and reviewing site permissions all work identically on ChromeOS as they do on Windows, Mac, or Linux. The extra layer is Guest browsing for shared or public Chromebooks (school labs, library computers, or any device more than one person logs into) since it keeps a session’s activity from persisting on the device once it’s closed.

This distinction trips people up because the search terms sound alike but point at completely different things. Someone searching for a “secure browser on Chromebook” for their kid’s school district is almost always after that exam-lockdown software, while someone searching “secure Chrome browser” on the same device usually wants the settings covered throughout this guide. If you’re not sure which one you need, ask what the goal is — locking the device down for a test, or making regular everyday browsing safer. The two rarely overlap in practice.

How Do I Keep My Tabs Safe If Something Goes Wrong?

None of the settings above protect your open tabs specifically, because that isn’t what they’re built for. Safe Browsing, Safety Check, HTTPS enforcement, and password security all protect you from external threats — malicious sites, breached credentials, bad extensions. They have nothing to do with a crash, an accidental window close, or a Chrome relaunch happening at the wrong moment.

That gap is exactly what BelayTab covers. It’s a browser extension that saves your open windows as named sessions, either with one click or the shortcut Ctrl + Shift + S (Cmd + Shift + S on Mac), and it also automatically snapshots each open window every 5 minutes and whenever a window closes — no manual step required.

If a reset, a crash, or a Chrome update does knock out your open windows, the Recovery screen brings together snapshots, deleted sessions, and the browser’s own recently closed windows in one place, instead of leaving you to hunt through separate menus:

• Version history. BelayTab keeps the last 20 versions of each session, and restoring never overwrites. It just adds a new version.
• 30-day trash. Deleted a session by mistake during a cleanup? It’s recoverable for 30 days, not gone instantly.
• No host permissions. BelayTab never reads page content. It only manages tabs, groups, and sessions, which matters if you’re already tightening down what extensions can see.

It’s free, doesn’t require an account, and works alongside every setting in this guide rather than replacing any of them. Chrome secures what happens on the web; BelayTab secures the tabs you had open while you were browsing it. See Restore Tabs for the full recovery picture, or download BelayTab and let it run quietly in the background from now on.

Run through this checklist once, and most of it stays set until you deliberately change it. Safe Browsing, HTTPS enforcement, and password sync options are all “set once” settings rather than things you’ll revisit weekly. Safety Check and an update check are the two worth putting on a recurring mental reminder — say, whenever you install something new or notice Chrome behaving oddly. Everything else on this list is a background layer that just needs to be turned on correctly the first time.