What is HTTPS?
HTTPS is the padlock in the browser address bar. It means the connection between your site and its visitors is encrypted, so nobody in between, like someone on the same coffee shop Wi-Fi, can read or change what is sent. It needs a certificate, which proves the site is really yours and has to be renewed before it expires.
ON THIS PAGE
What it means
Without HTTPS, everything travels as plain text: logins, forms and the pages themselves. With it, the traffic is scrambled so only your site and the visitor can read it.
Browsers show 'Not secure' on sites without it, and search engines treat it as a basic requirement.
Why it matters for vibe-coded apps
Most modern hosts turn HTTPS on for you, so problems usually come from details: a custom domain, a forgotten redirect or an expired certificate.
- Visitors see scary 'Not secure' or certificate warnings and leave.
- Logins and personal data can be read or altered in transit.
- An expired certificate takes your site offline for most visitors.
Example
Someone types your address without the https.
server {
listen 80;
server_name yourapp.com;
root /var/www/app;
}server {
listen 80;
server_name yourapp.com;
return 301 https://$host$request_uri;
}Add the Strict-Transport-Security header too, so browsers stop trying http at all.
How to check if your app has this problem
- 1Visit your site with http:// at the start. It should jump to https:// by itself.
- 2Click the padlock and check the certificate is valid and not close to expiring.
- 3Run a check for HTTPS and SSL, which tests this for you.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Switch on HTTPS and automatic certificate renewal in your hosting settings.
- 2Redirect every http address to https.
- 3Change any http:// links to images, scripts and APIs in your pages to https://.
- 4Add the Strict-Transport-Security header.
Make my site HTTPS only. Add a permanent redirect from http to https, change every http:// URL for images, scripts, fonts and API calls to https://, and add a Strict-Transport-Security header with a max-age of at least one year. Use my host's or framework's standard way to do this. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for HTTPS issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
Related reading
Need help?
Not sure what this means for your app? Our team will explain it in plain English.