Does your site load over HTTPS for every visitor?

The HTTPS check confirms that the pages a scan reads load over an encrypted connection with a certificate the scan could verify. A pass means traffic between visitors and your site is protected in transit, nothing more.

What does this check look at?

It looks at whether the pages a scan reads load over an encrypted connection with a certificate the scan could verify. It is the first thing every scan does, because nothing else on the connection can be trusted without it. MDN puts it plainly, all websites should serve all their pages and subresources over HTTPS.

The lock in the address bar only covers the trip between a visitor and your server. It does not mean the site is honest, and scam sites get the lock too.

Pulse and Deep scans both run it.

What does a result mean?

It does not show how data is stored once it arrives, or test every protocol and cipher the server accepts. A pass is about the connection only, so it says nothing about how your app stores passwords or data. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.

What does a confirmed finding have to show?

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

Most hosts turn HTTPS on for you. When a page still loads without it, this prompt finds where.

Make sure every page of my site loads over HTTPS. Check the hosting and framework settings for any route, domain or redirect that still serves plain HTTP, turn on the host's "force HTTPS" or "redirect HTTP to HTTPS" option, and make sure the certificate covers both the bare domain and the www address. Do not change anything else. Tell me which settings you changed.

How to check

Say Atlas, our example app at atlas.example, loads its homepage over HTTPS. The check passes, and the HSTS and mixed content checks then look at what happens around that connection.

The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.