Quick answer: Chrome shows “Insecure download blocked” when a file travels over plain HTTP instead of HTTPS. If you trust the file, open the Downloads bubble, click the three dot menu next to the blocked file and choose Keep. To allow it every time on one site, open Site settings for that site and set Insecure content to Allow.
Why is Chrome blocking your download?
Chrome flags a download as insecure when the file itself is delivered over HTTP, even if the page you clicked from uses HTTPS. That mix is called mixed content. Anyone on the network between you and the server could swap the file for something else, so Chrome stops it before it reaches your disk.
This is separate from Safe Browsing, which blocks files it believes are malicious and uses different wording such as “Dangerous file”.
What you need before you start
- Google Chrome on Windows, macOS, Linux, or ChromeOS.
- Confidence that the file and the website are trustworthy.
- Time needed: about two minutes.
Safety warning: only override this warning for a file you are sure about. A file downloaded over HTTP can be tampered with in transit. Scan anything you keep with antivirus software before you open it.
How do I keep a blocked download?
Chrome gives you a one time override for the file it just blocked.
- Click the Downloads icon in the Chrome toolbar, or press
Ctrl + J. - Find the blocked file in the list.
- Click the three dot menu next to it.
- Choose Keep and confirm.
How do I allow insecure downloads from one site?
If you download from the same site often, change the permission for that site only rather than for all of Chrome.
- Visit the website in Chrome.
- Click the icon to the left of the web address, then click Site settings.
- Find Insecure content in the list of permissions.
- Set it to Allow.
- Reload the page and start the download again.
Set it back to Block (default) when you are finished.
Is there a safer version of the file?
Before you override anything, check whether the same file is available over a secure connection.
- Look at the download link and see whether it starts with
http://. - Try the same address with
https://instead. - Check the official website or an official mirror for a secure link.
- Report the insecure link to the site owner so they can fix it.
Frequently asked questions
Is an insecure download always dangerous?
Not always. The warning is about how the file was delivered, not about what is inside it. A legitimate file on an old HTTP server triggers the same message. The risk is that the file could have been altered on the way to you, which is why scanning it afterwards matters.
Why does Chrome block some file types and not others?
Chrome is strictest with file types that can run code or change your system, such as installers and executables. Lower risk files such as images and text may pass through with no warning at all.
Will another browser download the file?
It might, because other browsers handle mixed content downloads differently. That does not make the file any safer. Using the Keep option in Chrome and scanning the file is the better approach.
Wrapping up
Chrome blocks insecure downloads because HTTP files can be swapped in transit. Use Keep for a one off file, or allow insecure content for a single trusted site, and scan whatever you download before opening it.
