Serve all pages over HTTPS
SkillWeb & browsingThe https skill is an agent skill for auditing whether a website or web application serves all of its content exclusively over HTTPS with a valid TLS certificate. It guides an agent through checking redirects, certificate validity, and hostname coverage, then explains what to fix and why plain HTTP puts passwords, session tokens, and personal data at risk.
Available today. Use it from your connected AI after setup.
No other account needed.
Have an agent that can load skills, and a website or web application to audit.
Then ask your AI: use the Serve all pages over HTTPS skill
What your AI can do with it
- Check whether all pages of a site are served over HTTPS
- Verify the TLS certificate is valid, not expired, and covers all hostnames including www
- Confirm HTTP requests redirect to HTTPS with a 301 status code
- Review server config, headers, forms, and integration points for HTTPS violations
- Explain how to obtain a TLS certificate via Let's Encrypt/Certbot and configure redirects
- Verify the certificate chain with SSL Labs, aiming for an A or A+ rating
Getting started
- Have an agent that can load skills, and a website or web application to audit.
- Add the https skill to the agent's available skills.
- Ask the agent to audit the site's HTTPS setup; it checks redirects, certificate validity, and hostname coverage.
- Review the findings and have the agent explain fixes such as obtaining a certificate and adding 301 redirects.
- Consult references/rule.md for full implementation details and framework-specific guidance.
What this skill tells your AI
The instructions your AI receives, as published by thedaviddias/front-end-checklist in skills/https/SKILL.md and read by ahel’s review.
Plain HTTP exposes every request and response to anyone on the network path — ISPs, Wi-Fi operators, and MITM attackers can read passwords, session tokens, and personal data without any warning to the user.
Quick Reference
- All HTTP traffic must redirect to HTTPS with a 301 (permanent) redirect
- TLS certificates must be valid, not expired, and cover all hostnames (including
www) - HTTPS is a prerequisite for HSTS, HTTP/2, Service Workers, geolocation, and other modern APIs
- Use a free certificate from Let's Encrypt or your hosting provider's managed TLS
- Verify the certificate chain with SSL Labs (ssllabs.com/ssltest) — aim for A or A+
Check
Check whether all pages of this website are served over HTTPS. Verify the TLS certificate is valid, not expired, and covers all hostnames. Confirm HTTP requests redirect to HTTPS with a 301 status code.
Fix
Configure the web server to obtain a TLS certificate (e.g., via Let's Encrypt/Certbot), redirect all HTTP requests to HTTPS with a 301 redirect, and ensure all internal links and resources use HTTPS URLs.
Explain
Explain why serving pages over HTTPS is essential for security, what happens when plain HTTP is used, and how to obtain and configure a TLS certificate.
Code Review
Review server config, headers, forms, and integration points related to Serve all pages over HTTPS. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/en/rules/security/https
Signals
- GitHub stars
- 74k
- Forks
- 7k
- Last commit
- Aug 2026
ahel review
K1binfo
installs-packages (in references/rule.md)
Automated review, not a security audit. Ruleset v1+k2.
Questions
- What does the https skill check?
- Whether all pages of a website are served over HTTPS, whether the TLS certificate is valid, unexpired, and covers all hostnames, and whether HTTP requests redirect to HTTPS with a 301 status code.
- Why is HTTPS required for a website?
- Plain HTTP exposes every request and response to anyone on the network path, such as ISPs, Wi-Fi operators, and MITM attackers, who can read passwords, session tokens, and personal data without any warning to the user.
Advanced
- Item type
- skill
- Key
https- Source
- github.com/thedaviddias/front-end-checklist