HTTPS: what it means when a page is not served over HTTPS

What HTTPS is

HTTPS is HTTP carried inside a TLS connection. It encrypts the request and the response, and it proves to the browser that the server holding the certificate is the one that owns the hostname. Without it, anything between the user and the server can read the page and change it before it arrives.

It is not optional infrastructure any more. Browsers mark plain HTTP pages as not secure, block most powerful web APIs on them, and Google treats HTTPS as a ranking signal. Certificates are free from Let’s Encrypt and issued automatically by most hosts.

What squirrel checks

The rule parses the URL of each crawled page and emits a single check named https:

• Fail when the parsed protocol is anything other than https:. Report message: Page not served over HTTPS, with the page’s actual protocol as the value and https: as the expected value. Severity error.
• Pass when the protocol is https:. Message: Page served over HTTPS.
• Fail when the URL cannot be parsed at all. Message: Invalid URL format, with the raw URL as the value.

The check is per-page, so a site that has migrated but still links to a handful of http:// URLs internally shows those pages individually rather than one site-wide verdict.

How to fix it

server {
  listen 80;
  server_name example.com;
  return 301 https://example.com$request_uri;
}

Issue a certificate, serve the site on 443, then send a permanent redirect for every HTTP URL. After the switch, update internal links, canonical tags and the sitemap to the https:// form, and re-audit for mixed content.

Enable / disable

Disable this rule

[rules]
disable = ["security/https"]

Disable all Security rules

[rules]
disable = ["security/*"]

Enable only this rule

[rules]
enable = ["security/https"]
disable = ["*"]

Related rules

• security/http-to-https: whether the HTTP versions of your URLs redirect to HTTPS at all.
• security/hsts: the header that stops the browser from trying HTTP again.
• security/mixed-content: HTTPS pages that still pull assets over HTTP.
• links/https-downgrade: internal links that point back at http://.

Security findings ship in every audit next to the SEO, performance and agent experience rules. See Website security scan with AI for how an agent works through a report.

References

• HTTPS, MDN glossary
• Why HTTPS matters, web.dev
• Transport Layer Security, MDN implementation guide

Check your site

Run squirrel audit https://example.com and open the Security section of the report. Every page that is not served over HTTPS is listed by page. Local audits are free.