Skip to content
Blog
Playbook

Your HTTPS is lying to you

The padlock in the address bar feels like the finish line. It's the start line. Certificates are free and automatic now, so having one proves almost nothing — what a scanner flags is everything around the cert.

The buckingfugs crewJuly 8, 20265 min read

Somewhere along the way, “does it have HTTPS?” became a solved question — Let's Encrypt hands out certificates for free, and most hosts wire one up for you. Which means the cert existing tells you almost nothing. The findings that end up in a scanner report, and in a shakedown email, are the four things people forget once the padlock shows up.

The four things that still go wrong

1

http:// that never upgrades

You have HTTPS, but plain http:// still serves your site instead of bouncing to the secure version. Anyone on the network can be handed the unencrypted page, or downgraded to it from an old link. The fix is a hard redirect — every http request 301s to https — locked in with HSTS.

2

Mixed content

An HTTPS page that pulls a script, image, or stylesheet over http://. The browser warns (or blocks it), and worse, that one insecure sub-request is a spot where someone in the middle can swap in their own code. Every subresource has to be HTTPS too.

3

A cert quietly about to expire

Auto-renewal that silently stopped running, or a manual cert nobody circled back to. An expired cert is the full-page, red-text browser warning that scares off every visitor — self-inflicted downtime with a countdown you weren't watching.

4

Ancient protocols still enabled

TLS 1.0 and 1.1 are deprecated and known-weak, but plenty of servers still accept them for “compatibility.” They're easy scanner fodder. Modern clients only need TLS 1.2 and 1.3 — turn the old ones off.

Check it in a minute

terminal
$ curl -sI http://yourdomain.com
# want a 301/308 to https:// — not a 200 serving over http
$echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates
# shows notBefore / notAfter — mind the expiry

And the low-tech check: click the padlock in your browser and read the certificate — issuer, expiry, and whether the page reports any “not fully secure” mixed-content notice.

The fixes

  1. 1

    Force the redirect.

    Send every http request to https with a 301, at your server, host, or CDN.
  2. 2

    Turn on HSTS.

    Once the redirect is solid, add the Strict-Transport-Security header so browsers refuse to even try http next time.
  3. 3

    Drop old TLS versions.

    Set your minimum to TLS 1.2, prefer 1.3, and disable 1.0/1.1 in your server or CDN's TLS settings.
  4. 4

    Chase down mixed content.

    Find every http:// subresource and make it https://. The browser console lists them for you.
  5. 5

    Put expiry on a leash.

    Even with auto-renewal, add an expiry alert as a backstop — the whole point of the failure is that it happens silently.

None of this is exotic. It's the difference between “we have a cert” and “HTTPS is actually enforced” — and that gap is exactly what a scanner is built to spot.

Want to know if your HTTPS is actually enforced, or just present? The scan checks redirects, expiry, and protocol versions in about 20 seconds.

Scan your site free →