HTTPS

Unencrypted tracking is a data-leak risk and breaks modern browser defaults.

What we check

Checks whether the page is served over HTTPS.

Why it matters

Unencrypted tracking is a data-leak risk and breaks modern browser defaults.

Common causes

The certificate expired or does not cover the subdomain, the browser warns.
The HTTP variant does not redirect, both versions run in parallel and split the signals.
Mixed content: the page itself is HTTPS but loads individual resources over http://.

The fix

Set up a TLS certificate (Let's Encrypt is free), 301-redirect HTTP, then add an HSTS header.

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Related checks

Security headers →Pre-consent cookies →

Asked often

What does a failing "HTTPS" check mean?

Unencrypted tracking is a data-leak risk and breaks modern browser defaults. Set up a TLS certificate (Let's Encrypt is free), 301-redirect HTTP, then add an HSTS header.

How do you fix a failing "HTTPS" check?

Set up a TLS certificate (Let's Encrypt is free), 301-redirect HTTP, then add an HSTS header.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint