HTTPS-Only Mode in Chrome, Firefox, Edge and Safari

HTTPS-only mode asks your browser to use an encrypted HTTPS connection whenever you visit a website, rather than quietly falling back to unencrypted HTTP. If a site cannot load securely, the browser warns you so you can decide whether to continue; the setting does not make every site support HTTPS or protect you from every online threat.

What You’ll Need

A current version of Chrome, Firefox, Edge or Safari.
Access to the browser’s settings. On a work or school device, an administrator may control the setting.
A working internet connection. Some older websites or devices may not work over HTTPS.

Step-by-Step

Choose the browser you want to configure. HTTPS-only settings are separate in each browser. Turning the feature on in one browser does not change another browser’s behavior.
In Chrome, open Security settings. On a computer, open Chrome, select the three-dot menu, then choose Settings > Privacy and security > Security. Scroll to Always use secure connections and switch it on. On Android, open the three-dot menu and go to Settings > Privacy and security; look for Always use secure connections and enable it if your version offers the option. Chrome’s settings can differ by device and release.
Choose how Chrome handles sites without HTTPS. If Chrome shows a choice between warning on public sites and warning on all sites, choose the stronger option if you want HTTPS-only behavior everywhere. With the public-sites choice, Chrome may still use HTTP for sites it considers local or private. When a warning appears, check the address and use the secure version if available; proceed to an unencrypted site only if you understand the risk and trust the connection.
In Firefox, open Privacy & Security. Select the menu button, choose Settings (called Preferences on some systems), then select Privacy & Security. Find HTTPS-Only Mode and choose Enable HTTPS-Only Mode in all windows for the broadest coverage. You can instead enable it only in private windows if you do not want it for regular browsing. On mobile, open Firefox’s menu, then Settings > HTTPS-Only Mode, if that option is available in your version.
In Edge, open Privacy, search, and services. Select the three-dot menu, then Settings > Privacy, search, and services. Find Security and switch on Automatically switch to more secure connections with Automatic HTTPS. If Edge offers a choice, select the option that switches to HTTPS on all sites, rather than only sites known to support it. The wording and availability can vary by platform and release.
In Safari, use the built-in protections available for your device. Safari does not provide a general, user-facing HTTPS-only switch equivalent to Firefox’s. On iPhone or iPad, open Settings > Apps > Safari (on some versions, find Safari directly in Settings) and turn on HTTPS-Only Mode if it appears. Availability depends on the operating-system version and device. On Mac, Safari’s standard settings do not include a general HTTPS-only toggle; keep Safari and macOS updated, and use HTTPS addresses when available. Do not assume a Safari privacy option provides HTTPS-only enforcement.
Check that the setting is active. Return to the relevant settings page and confirm the switch or selected option remains enabled. Then test a site you know supports HTTPS by entering its address. The address bar should show an HTTPS address or a secure-connection indicator; browser icons and wording vary.
Handle a site that triggers a warning carefully. First check for a typo in the web address and try typing https:// before the domain. If the site still fails, it may not support HTTPS, may have a certificate problem, or may be blocked by a network. Avoid entering passwords, payment details or other sensitive information over HTTP. Use the browser’s temporary continue or exception option only when the site is trusted and the information you share is not sensitive.

Common Mistakes

Assuming the feature is identical everywhere. Firefox, Chrome and Edge have different controls, and their mobile versions may not match desktop. Safari’s support is limited and version-dependent.
Confusing HTTPS with a guarantee that a site is trustworthy. HTTPS encrypts the connection between your browser and the site. It does not prove the site is honest, free of scams or safe to download from.
Ignoring a certificate warning. A warning can indicate a misconfigured site, an incorrect device clock or a connection being interfered with. Do not bypass it to reach a page where you would enter sensitive information.
Expecting every page or embedded item to use HTTPS. A secure main page can still have problems with content loaded from other addresses. Browser protections and warnings vary.
Looking for a desktop Safari switch that is not there. Check your operating-system version and the available Safari settings rather than relying on instructions for another browser or device.

Tips

Use the all-sites option when available if your goal is to avoid HTTP wherever possible. A more limited option may allow some sites to load without encryption.
Bookmark the correct HTTPS address for sites you use often. This can avoid repeated warnings caused by old HTTP bookmarks.
Keep your browser and operating system updated. Updates can add settings, fix security issues and improve HTTPS handling.
If a trusted site fails, contact its owner or use its official app or support channel to ask whether HTTPS is supported. Do not send passwords through an insecure page.
Remember that HTTPS-only mode is one layer of protection. It does not replace careful link checking, strong unique passwords or other basic account-safety practices.

Troubleshooting

The setting is missing: Confirm you are in the correct browser and on the correct device. Search the settings page for “HTTPS” or “secure connections,” update the browser, and check whether a work or school administrator manages browser policies. Safari may not offer a general switch on your device.

A site will not open: Check the address for typos, confirm your device date and time are correct, and try the site’s HTTPS address directly. If the browser reports a certificate problem, do not dismiss it automatically. Try another network only if appropriate, then contact the site owner if the problem continues.

The site opens but some features are broken: It may rely on an HTTP service, an outdated redirect or content that is not available securely. Try the site’s official support route. If you must use a temporary exception, avoid sensitive information and turn HTTPS-only protection back on afterward.

The change does not stick: Reopen settings and check again. Managed browser policies, profiles or extensions can affect behavior. On a managed device, ask the administrator rather than trying to override their configuration.

Frequently Asked Questions

Does HTTPS-only mode force every website to use HTTPS?
No. It tries HTTPS first and may block or warn about insecure connections, but a site that does not support HTTPS cannot be made secure by the browser setting.

Is HTTPS-only mode the same as a VPN?
No. HTTPS encrypts traffic between your browser and a particular website. A VPN routes network traffic through a VPN provider, which is a different service and does not make an insecure website trustworthy.

Can I still visit a website that only uses HTTP?
Often you can choose to continue when the browser warns you, but the connection is not encrypted. Avoid sharing passwords, payment details or private information on that page.

Does Safari have HTTPS-only mode?
Some Apple devices and operating-system versions offer a setting named HTTPS-Only Mode. Safari on Mac does not generally expose an equivalent switch in its standard settings, so check your device’s current options.

Why does a secure site still show a warning?
The site may have an expired, incorrect or otherwise invalid certificate, or your device’s clock may be wrong. Check the time and address, then contact the site owner; do not bypass certificate warnings for sensitive tasks.

Will HTTPS-only mode block all tracking or malware?
No. It protects the connection from being sent over ordinary HTTP when HTTPS is available, but it does not block all tracking, malicious sites, harmful downloads or account compromises.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →