Base securitySeverity high
Site served over insecure HTTP
A site served over HTTP sends everything in plain text — session cookies, submitted passwords, page content. On a public network (café wifi, shared hotspot), anyone on the same network can intercept that traffic.
Why it still happens
Rare in 2026 on a modern host (Vercel, Netlify provide HTTPS automatically), but it happens on a manually configured VPS, a forgotten subdomain, or a dev environment exposed by mistake.
The fix
- Get an SSL/TLS certificate — free via Let's Encrypt if you run your own server; automatic on Vercel/Netlify.
- Force the HTTP → HTTPS redirect at the server level.
- Once HTTPS is active everywhere, enable HSTS to prevent any fallback:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadOnly enable it once you're certain HTTPS works on every subdomain — HSTS with includeSubDomains stops the browser from ever falling back to HTTP, even temporarily, which can break a subdomain that doesn't have a certificate yet.
Check it yourself
curl -I http://yoursite.com
# If the response isn't a 301/308 redirect to https://, it's brokenCheck whether your site is affected by this vulnerability.
Scan my app