Links from an HTTPS page to an http:// destination
A link that drops the visitor to plain HTTP hands their next request to the network. squirrel flags every explicit http:// link on an HTTPS page.
What an HTTPS downgrade link is
A downgrade link is an <a href="http://..."> on a page that was itself served over HTTPS. Unless something upgrades it first, following it takes the visitor to an unencrypted connection where the request and the response can be read and modified in transit. HSTS on the destination host, or a browser in HTTPS-only mode, will rewrite or block it, which is protection you do not control from your own markup.
This is separate from mixed content. Mixed content is about subresources the page loads itself, which the browser blocks or upgrades on its own. A navigation link gets no such treatment from the page: whether it is upgraded depends on the destination’s policy and the visitor’s browser settings.
What squirrel checks
The rule runs on every crawled page. It emits a single check named https-downgrade:
- Info when the page itself is not HTTPS, since there is nothing to downgrade from. Message:
Page is not HTTPS, downgrade check not applicable. - Warn when any
a[href]has an href that literally starts withhttp://. Message:4 link(s) downgrade to HTTP, with each href listed. Severity warning, weight 5. - Pass otherwise. Message:
No HTTPS to HTTP downgrades.
The test is on the raw attribute text, so protocol-relative hrefs such as //example.org/page are not flagged, and neither is a relative link. The check does not distinguish internal from external destinations.
How to fix it
<a href="https://example.org/reference">Reference</a>Change the scheme where the link is authored. For internal links this is always the right fix, since your own site serves HTTPS. For an external destination, check that the target actually supports HTTPS before rewriting, and reconsider linking there at all if it does not.
| Rule ID | links/https-downgrade |
| Category | Links |
| Scope | Per-page |
| Severity | warning |
| Weight | 5/10 |
Enable / disable
Disable this rule
[rules]
disable = ["links/https-downgrade"]Disable all Links rules
[rules]
disable = ["links/*"]Enable only this rule
[rules]
enable = ["links/https-downgrade"]
disable = ["*"]Related rules
- security/mixed-content: subresources loaded over HTTP, which browsers do block.
- security/https: whether the page itself is served over HTTPS.
- security/http-to-https: whether the HTTP forms of your own URLs redirect.
- links/external-links: the outbound links this rule reads.
Links findings ship in every audit next to the SEO, performance and agent experience rules. See Fix SEO issues with AI for how an agent works through a report.
References
Check your site
Run squirrel audit https://example.com and open the Links section of the report. Every downgrading link is listed with its href. Local audits are free.