Directive: upgrade insecure requests

Overview

Note

This is an extension to CSP, which is defined in W3C: Mixed Content.

The upgrade-insecure-requests directive instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for websites with large numbers of insecure legacy URLs that need to be rewritten.

The upgrade-insecure-requests directive will NOT ensure that users visiting your site via links on third-party sites will be upgraded to HTTPS for the top-level navigation and thus does not replace the Strict-Transport-Security (HSTS) header, which should still be set with an appropriate max-age to ensure that users are not subject to SSL stripping attacks.

Important

The upgrade-insecure-requests directive is evaluated before block-all-mixed-content and if it is set, the latter is effectively a no-op. Since block-all-mixed-content is obsolete, this should be used instead.

Usage examples

It is either on or off. It has no value.

upgrade-insecure-requests

Fallbacks

❌ upgrade-insecure-requests does not fallback to default-src.

Possible errors

None

References

• W3C: Mixed Content
• MDN Web Docs reference
• Can I use upgrade-insecure-requests?