| name | https-downgrade |
| description | Use when auditing a site's internal and external links for protocol consistency, migrating a site from HTTP to HTTPS, or reviewing hardcoded URLs in a codebase that may use `http://` instead of `https://`. |
| metadata | {"category":"seo","priority":"medium","difficulty":"intermediate","estimatedTime":"10","source":"frontendchecklist.io","url":"https://frontendchecklist.io/en/rules/seo/https-downgrade"} |
Do not link from HTTPS to HTTP
Linking from a secure HTTPS page to an HTTP destination creates a mixed content situation that browsers warn users about or block entirely. It also means the linked page does not receive the ranking signal passed through the HTTPS referrer. For internal links, it can cause redirect loops or broken navigation.
Quick Reference
- All internal links on an HTTPS page must point to HTTPS URLs — HTTP links trigger mixed content warnings
- External links to HTTP destinations break the security chain and may be blocked by browsers
- Use protocol-relative URLs (
//example.com) or absolute HTTPS URLs — never hardcode http:// for internal links
Check
On pages served over HTTPS, scan all <a href> attributes for URLs starting with http:// (not https://). Flag: (1) Internal links using http:// that should use https:// or a relative path. (2) External links to third-party sites still on HTTP (flag for review — the destination may not support HTTPS). (3) Resource links (<img src>, <script src>, <link href>) pointing to HTTP URLs — these cause active mixed content warnings.
