SEC-001
Site is not served over HTTPS
CriticalDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Whether the final page URL uses HTTPS.
Why it matters
Without HTTPS, logins, sessions and form data travel in plain text and can be read or changed on public networks.
Recommended fix
Serve the site over HTTPS only and redirect every HTTP request to HTTPS.
How to verify
Open the http:// address and confirm it redirects to https:// with a padlock in the browser.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-001: Site is not served over HTTPS
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Make the app load only over HTTPS: enable HTTPS on the hosting platform and add a permanent (301/308) redirect from every http:// URL to the same https:// URL.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Open the http:// address and confirm it redirects to https:// with a padlock in the browser.