Security · Review & audit
https
/https
Use when auditing whether a website or web application serves content exclusively over HTTPS with a valid certificate.
For whom
- Author
- thedaviddias ↗
- Repository
- front-end-checklist ↗
- Licence
- MIT
- Last repository change
- 06.10.2026
Assessment and security
100/ 100Class: good
Format25 / 25
Frontmatter with name and description, valid name, description up to 1,024 characters, name matching the folder.
Discoverability25 / 25
Description explains when to use the skill, has a reasonable length and uses third person.
Content35 / 35
At least 150 words and at most 500 lines, headings, step lists, examples or code.
Hygiene15 / 15
No placeholders such as TODO, no Windows paths, with a licence.
Riskno signals detected in the scan
- Files in this package
- 2
- Scripts
- 0
- HTML comments
- 0
- URLs in SKILL.md
- 2
Deprecation
No signals detected. Repository changed on 06.10.2026, without references to retired models or APIs.
Licence
MIT, open: use and modify while retaining author attribution.
What it does and when to use it
Use when auditing whether a website or web application serves content exclusively over HTTPS with a valid certificate.
Original author description
Use when auditing whether a website or web application serves content exclusively over HTTPS with a valid certificate.
How it works
- Quick Reference
- Check
- Fix
- Explain
- Code Review
Original SKILL.md headings · 36 lines, 265 words
SKILL.md preview
--- name: https description: "Use when auditing whether a website or web application serves content exclusively over HTTPS with a valid certificate." metadata: category: security priority: critical difficulty: beginner estimatedTime: "30" source: frontendchecklist.io url: https://frontendchecklist.io/rules/security/https --- # Serve all pages over HTTPS Plain HTTP exposes every request and response to anyone on the network path — ISPs, Wi-Fi operators, and MITM attackers can read passwords, session tokens, and personal data without any warning to the user. ## Quick Reference - All HTTP traffic must redirect to HTTPS with a 301 (permanent) redirect - TLS certificates must be valid, not expired, and cover all hostnames (including `www`) - HTTPS is a prerequisite for HSTS, HTTP/2, Service Workers, geolocation, and other modern APIs - Use a free certificate from Let's Encrypt or your hosting provider's managed TLS - Verify the certificate chain with SSL Labs (ssllabs.com/ssltest) — aim for A or A+ ## Check Check whether all pages of this website are served over HTTPS. Verify the TLS certificate is valid, not expired, and covers all hostnames. Confirm HTTP requests redirect to HTTPS with a 301 status code. ## Fix Configure the web server to obtain a TLS certificate (e.g., via Let's Encrypt/Certbot), redirect all HTTP requests to HTTPS with a 301 redirect, and ensure all internal links and resources use HTTPS URLs. ## Explain Explain why serving pages over HTTPS is essential for security, what happens when plain HTTP is used, and how to obtain and configure a TLS certificate. ## Code Review Review server config, headers, forms, and integration points related to Serve all pages over HTTPS. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response. --- For full implementation details, code examples, and framework-specific guidance, see `references/rule.md`. Rule page: https://frontendchecklist.io/rules/security/https
Files in this package (2)
- SKILL.md 2 KB
- references/rule.md 5 KB
Versions
The database has no other skills named https.
Database snapshot: 13.11.2026 · package version 21208006b05b (SHA-256 digest of the entire package)
Downloads in the last 30 days: 0 · ranking
Report a problem with this skill: harmful content, incorrect descriptions or an author’s removal request.
Similar skills
- 100https-certificate-checker
Validate https certificate checker operations. Auto-activating skill for Security Fundamentals. Triggers on: https certificate checker, https certificate checker Part of the Security Fundamentals skill category. Use when working with https certificate checker functionality.… - 100form-https
Use when reviewing HTML forms, fetch/XHR calls, and form action attributes to ensure data is submitted exclusively over HTTPS. - 100http-to-https
Use when checking whether a web server is configured to redirect all HTTP traffic to HTTPS. - 100ssl-https
HTTPS and SSL/TLS audits: certificates, mixed content, HTTPS redirect chains, HSTS and security headers. Use for mixed content, HTTP URLs, certificate issues or HTTP to HTTPS migrations. - 100website-security
Check and fix the security basics of a website or web app — HTTPS, security headers, forms, cookies, secrets in the frontend, admin exposure. Use when building or launching a site, when the user shares a URL to check, or before linking a site from a public profile. - 100deploy-web-stack
Deploy a complete web application in a Kube-DC Project — a managed database (PostgreSQL, MySQL or MariaDB) with delivered credentials, an optional persistent volume, and an HTTPS hostname with a platform certificate through the shared Gateway, without a public IP. Use for…