HTTPS-Only Mode in Waterfox

HTTPS-Only Mode forces every connection to use HTTPS. If a site is reachable over plain HTTP, Waterfox upgrades the request rather than sending it unencrypted, and if no secure version exists it warns you instead of silently falling back.

HTTP and HTTPS

Plain HTTP sends everything in the clear. Anyone between you and the server — another device on the same Wi-Fi, the network operator, an ISP — can read the pages you request, and can modify them in transit. HTTPS wraps the same protocol in TLS, so the connection is encrypted and tamper-evident.

Most sites support HTTPS. Many still answer on both, which means a mistyped or old link can quietly drop you onto the unencrypted version.

Turn HTTPS-Only Mode on or off

Click the menu button, then select Settings.
Select Privacy and security.
Scroll to Connection and software security and select Advanced settings.
Choose whether to enable HTTPS-Only Mode in all windows, only in private windows, or not at all.

Waterfox also upgrades connections independently of this setting. See Connection upgrades for how that works and how the two interact.

The “Secure Site Not Available” page

Some sites only answer over HTTP. With HTTPS-Only Mode on, you get a warning page rather than an unencrypted connection.

Continue to HTTP Site accepts the risk and loads the unencrypted version. HTTPS-Only Mode is turned off for that site temporarily.
Go Back returns you to where you were, with nothing sent in the clear.

Turn it off for one site

If you regularly use a site that has no HTTPS version, or that renders incorrectly when upgraded:

Select the icon at the left of the address bar to open the trust panel.
Select the connection entry.
Under Automatically upgrade this site to a secure connection, select Off.

Add exceptions in Settings

Open Settings and select Privacy and security.
Scroll to Connection and software security and select Advanced settings.
In the HTTPS-Only Mode section, open the Exceptions dialog.
Enter the exact address of the site.
Choose whether the exception is permanent or lasts only for this session.
Select Save Changes.

Tip

Exceptions cannot be added for private windows. Private windows always attempt the secure connection.

Adapted for Waterfox from the original Firefox article HTTPS-Only Mode in Firefox. Original content by Mozilla Contributors. Licensed under the CC BY-SA 3.0.