This is a feature request, and not a security bug per-se. Removing restrictions.

Having said that, this is something we've considered in the past, but we may wish to re-evaluate.

OP, can you please clarify what you mean by "cant test sites for https only mode"?

I've been meaning to file a feature request like this for quite a while. Basically I think we can and should add a boolean option in Settings to

  [x] Only Use Secure Transport

We could either implement it to mean "simply don't make any HTTP, WS, or FTP requests", or we could implement it to mean "treat HTTP and FTP as typos for HTTPS, and WS as a typo for WSS". Or (less awesome because more UX complexity) we could add a 2nd, dependent checkbox to toggle between those 2 meanings:

  [x] Only Use Secure Transport
    [x] Upgrade Non-Secure Requests

My preference would be for 1 checkbox, and to have it mean "upgrade". Obviously, this checkbox would have to be off by default, but it would be there for the paranoid.

I have a trivial extension that does this, but it doesn't apply to WS and FTP, and it's probably not as fast as it would be as a native feature in C++ at the right layer(s).

Could be a GoodFirstBug for an open source contributor, too? Or maybe a good second bug.

I don't think this is a Blink security feature; it's a bit of UX to change behavior in the net/ stack.

Adding to Hotlist-Privacy. Strictly taken this is a security bug, but I can imagine that this could be a good first bug for someone on privacy team too.

If someone wanted to pick it up, I've got the beginnings of a CL: https://chromium-review.googlesource.com/c/chromium/src/+/1157245

Couple of questions/comment;s

1) Is this feature targeting most users, or just power users? Could it be just a runtime flag instead of a checkbox/toggle in settings?
2) If putting it in Settings is justified, I'd suggest avoiding the double checkbox approach. Either decide on a single setting, or turn it to a dropdown with the available options, if more than 2 exist, like [off, only use, upgrade].

#7: I understand it to be the case that very few people ever even look at the Settings page. So just about anything there is a 'power user' feature; certainly anything in Advanced.

I think that is perfectly OK.

I would argue against exposing the feature only as a command-line flag (if that is what you meant). Even fewer people know about those.

I would like for this to be a supported, visible, discoverable feature. Even if few people end up using it, as indeed I expect to be the case, I'd like for those who want it to be able to discover it and use it effectively.

I would +1 not using command line flags. Those are not available to even be set on ChromeOS and Android, only available on desktop and really hard to figure out how to do in some cases (MacOS).

This option may be recommended in a corporate environment

Or could be set by privacy extensions.