How Firefox HTTPS-Only Mode Upgrades HTTP and Alerts Users

This article provides a complete overview of how HTTPS-Only Mode functions within the Mozilla Firefox web browser. You will learn how the browser intercepts insecure web traffic to automatically upgrade connections to encrypted HTTPS, how it handles insecure elements within a webpage, and how it alerts and protects users when a target website does not support secure connections.

The Automatic Connection Upgrade Process

Normally, when you type a web address into Firefox without specifying a protocol, or when you click an old http:// link, the browser connects to the website without encryption. This leaves your data vulnerable to interception. When HTTPS-Only Mode is enabled, Firefox changes this behavior through a strict interception and upgrade process:

  1. Request Interception: Before Firefox sends your request across the internet to the website's server, it intercepts the outgoing http:// connection inside the browser.
  2. Protocol Rewriting: Firefox automatically rewrites the request, changing http:// to https://.
  3. Secure Handshake: The browser attempts to establish a secure, encrypted connection with the website's server using the upgraded HTTPS address.
  4. Seamless Loading: If the server supports HTTPS, the secure webpage loads normally. The user experiences no interruption, and the padlock icon appears in the address bar.

This upgrade process applies not only to the main webpage you are visiting (top-level navigation) but also to all sub-resources on that page. If a secure website tries to load an insecure script, stylesheet, or media file via HTTP, Firefox will automatically attempt to upgrade those background requests to HTTPS as well.

How Firefox Alerts Users When Upgrades Fail

Many legacy websites still do not support HTTPS. When Firefox attempts to upgrade a connection for a site that only operates on HTTP, the secure connection request will either be rejected by the server or time out.

Instead of silently falling back to the insecure HTTP version—which would defeat the purpose of the security feature—Firefox halts the connection entirely and triggers a full-page warning.

The HTTPS-Only Mode Alert Screen

When an upgrade fails, Firefox displays a prominent "Secure Site Not Available" alert screen. This screen informs the user of the following:

  • You have HTTPS-Only Mode enabled for enhanced security.
  • Firefox attempted to connect to the website securely, but the upgraded HTTPS version is not available.
  • Connecting to the website as-is requires using an unencrypted HTTP connection, which carries privacy and security risks.

User Options on the Alert Screen

The alert screen prevents any data from being sent to the insecure site until you make an explicit choice. Firefox presents two options:

  • Go Back (Recommended): This button cancels the request entirely and returns you to the previous safe page, keeping your browsing session fully encrypted.
  • Continue to HTTP Site: If you trust the website or do not need to enter sensitive information (like passwords or credit card numbers), you can click this button to bypass the block.

Managing Temporary Exceptions

If you choose to click "Continue to HTTP Site" on the alert screen, Firefox creates a temporary exception for that specific domain. The browser will load the insecure HTTP version of the site and display a crossed-out padlock icon in the address bar to remind you that the connection is not private.

Once you close the browser or manually turn the setting back on via the padlock icon in the address bar, Firefox will revoke the exception and return to enforcing HTTPS-Only Mode for that website in the future.