Home / Fix guides / No HTTPS
Your app isn't using HTTPS: how to fix it
High
Your site ends up on an http:// URL. Everything, including passwords and session cookies, travels unencrypted.
Why it matters
Anyone on the same network (café Wi-Fi, ISP) can read or change the traffic.
Quick fix
- Enable HTTPS at your host (Vercel/Netlify/Cloudflare do this automatically for connected domains).
- Redirect all http:// requests to https://.
- Then add HSTS.
Step by step
Enable TLS
Most modern hosts issue free certificates automatically. On your own server, use Let's Encrypt (certbot).
Prompt for your AI builder
Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.
Make my app HTTPS-only: redirect every http:// request to https:// and add a Strict-Transport-Security header.