EngineeringScore
Security Medium

Serve the site over HTTPS

HTTPS encrypts everything that travels between a visitor's browser and the server, so it is the baseline every other security control assumes is already in place. Modern browsers actively punish sites that lack it: Chrome and Firefox both mark plain-HTTP pages as "Not Secure" in the address bar, and any page that collects a form field is flagged even more aggressively.

Why it matters

Without HTTPS, browsers flag the site as "Not Secure" and all traffic, including passwords and payment details, travels in plaintext, exposing customers to interception and eroding trust.

How to fix

  1. 1 Obtain a TLS certificate (e.g. via Let's Encrypt or your host/CDN).
  2. 2 Configure the web server or CDN to terminate TLS on port 443.
  3. 3 Redirect all HTTP requests to HTTPS.
  4. 4 Update any hardcoded http:// links in the app.

Common mistakes

  • Enabling HTTPS on the main domain but forgetting subdomains (api., cdn., staging.) that also handle sensitive traffic.
  • Leaving the certificate on auto-issue without monitoring expiry, so the site silently breaks weeks or months later when it lapses.
  • Terminating TLS at the CDN/load balancer but leaving the connection from the CDN to the origin server unencrypted, so data is only protected for half the trip.

How to verify

  1. 1 Load the site and confirm the browser shows a padlock with no mixed-content or certificate warnings.
  2. 2 Run the URL through an SSL checker (e.g. SSL Labs) to confirm the certificate chain is valid and not near expiry.
  3. 3 Request the HTTP version of the URL directly and confirm it redirects to HTTPS rather than serving content.

Related checks

Security HSTSSecurity Mixed ContentBest Practices HTTPS RedirectSecurity Cookies Secure

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site