Missing https
security.headers.missing_https
- Outcome class
- Automatic. An automated check that can report a confirmed violation.
- Area
- Security, response headers
What the rule checks
Scope. Applies to every audited URL that answered: the scheme of the final URL after redirects is the transport. Always applicable: the check judges the response itself (its transport or one of its headers), and every successfully fetched response has a scheme and a header set, so no page lies outside its scope.
Expectation. Fails when the final URL of the fetched document is not https:. A certificate the client cannot validate is no HTTPS: the fetch fails and nothing is measured (errored), it never passes. An https: response validated against the trusted roots passes.
Always applicable: every fetched URL has a scheme. Note: the corpus serves on 127.0.0.1, which Secure Contexts ('Is origin potentially trustworthy?') treats as potentially trustworthy; the check deliberately judges the scheme, since an audit of a local build stands in for the deployed site.
Source. RFC 9110 §4.2.2 (https URI scheme); OWASP Transport Layer Security Cheat Sheet; auditmysite #775 (final URL decides)
Detection: analyze_security; needs network.
Failing example
The check reports a violation here. Corpus case baseline_headers_present. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENYPassing example
The check passes here and reports nothing. Corpus case hsts_preload_eligible. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYThis page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.