Check explainer
HTTPS
Unencrypted tracking is a data-leak risk and breaks modern browser defaults.
- critical
- ok
What we check
Checks whether the page is served over HTTPS.
Why it matters
Unencrypted tracking is a data-leak risk and breaks modern browser defaults.
Common causes
- The certificate expired or does not cover the subdomain, the browser warns.
- The HTTP variant does not redirect, both versions run in parallel and split the signals.
- Mixed content: the page itself is HTTPS but loads individual resources over http://.
How to fix it
Set up a TLS certificate (Let's Encrypt is free), 301-redirect HTTP, then add an HSTS header.
What does a failing HTTPS finding mean?
Unencrypted tracking is a data-leak risk and breaks modern browser defaults. Set up a TLS certificate (Let's Encrypt is free), 301-redirect HTTP, then add an HSTS header.
How do you fix HTTPS?
Set up a TLS certificate (Let's Encrypt is free), 301-redirect HTTP, then add an HSTS header.