scan.now
Premium Scan a site

Link uses plain HTTP

The link uses plain http://, so anything you send to the page, including a password, would travel unencrypted, and the page itself could be altered on the way.

Do this: Enter nothing; the connection is not encrypted. Anything typed into the page travels in the clear, and the page itself can be rewritten in transit.
PassThe link uses HTTPS.
MediumThe link uses unencrypted HTTP.

The fix, in one snippet

Example to adapt What is missing 
http://example.com/login   <- no encryption, no certificate

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

The checker reads the scheme, then tests whether the host also serves HTTPS and whether the HTTP address redirects to it; if it does, the finding is downgraded to information because the link is merely old. It parses the fetched page for forms: a password field on an HTTP page is high severity. It also records whether the HTTPS site sends Strict-Transport-Security. Limits: the exposure is the first request, before any redirect; Chrome, Firefox and Safari now upgrade many navigations automatically (HTTPS-First and HTTPS-Only modes), so what actually happens depends on your browser settings.

Why it matters

HTTPS is not a trust signal. Phishing sites have used free certificates for years, and APWG reported the majority of phishing pages on HTTPS by 2020, so the padlock proves only that the connection is encrypted to whoever owns the name. The absence of HTTPS is a different signal. A login page over plain HTTP in 2026 is either amateur or an on-path attacker's, and on a public network anyone between you and the server can read the form data or rewrite the page to add one. People on hotel, café and airport Wi-Fi carry the most risk.

How to fix it

Turn on the browser's HTTPS-only behaviour: Firefox: Settings > Privacy & Security > HTTPS-Only Mode in all windows. Chrome: Settings > Privacy and security > Security > "Always use secure connections". Edge: Settings > Privacy, search, and services > Automatic HTTPS. Safari: upgrades known HTTPS-capable sites automatically and labels the rest "Not Secure". Never type a password on a page marked Not Secure. Site owners: fix the server side with HTTPS availability, the HTTP redirect and HSTS. Guides: HTTPS-Only mode and HSTS explained.

Where this fits

Link uses plain HTTP is check 7 of 13 that the phishing url checker runs under url and phishing indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Domain registered very recently (medium), where the domain was registered very recently, which is typical of phishing infrastructure that is created, used for days and discarded. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

Link uses plain HTTP closes one route in. Immediately below it: Long or cross-domain redirect chain, where following the link produced several redirects, or a redirect onto a different domain, so where you land is not where the link appears to go; Page asks for credentials, where the page at the link asks for a username and password, so if anything else about the URL is off, this is where the credentials would be harvested; URL uses a raw IP address as host, where the link points to a bare IP address instead of a domain name, which legitimate consumer services almost never do.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Link uses plain HTTP (medium severity)
Scanner check id: url-no-https
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. Mozilla: HTTPS-Only Mode in Firefox
  2. Google: Manage Chrome safety and security (Always use secure connections)
  3. Chromium Blog: Towards HTTPS by default
  4. APWG: Phishing Activity Trends Reports

Related guides

7 min read · Updated Sep 14, 2026 HTTPS-Only Mode: What It Protects and Why You Should Turn It On

HTTPS-Only mode makes the browser refuse plain HTTP connections unless you explicitly allow them. What an unencrypted connection...

Read the guide 8 min read · Updated Sep 17, 2026 HSTS Explained: Strict-Transport-Security, Preloading and the Downgrade Attacks It Stops

HTTP Strict Transport Security tells the browser to never load a site over plain HTTP again. The header, max-age and includeSubDomains,...

Read the guide