Does Tor Warn You If a Site Lacks HTTPS?

Tor Browser actively warns you whenever you attempt to access an unencrypted HTTP website on the regular web. Utilizing a built-in HTTPS-Only Mode, the browser automatically attempts to upgrade every connection to secure HTTPS. If an encrypted connection cannot be established, Tor blocks the page and displays a prominent warning screen asking if you want to proceed over an insecure connection.

How Tor Handles Plain HTTP Websites

Tor Browser is built on Mozilla Firefox ESR and comes with HTTPS-Only Mode enabled by default. When you enter a URL or click a link that uses plain http://, the browser takes the following steps:

1. Automatic Upgrade: Tor attempts to establish a secure https:// connection with the server.
2. Failure Detection: If the web server does not support HTTPS or has an invalid SSL/TLS certificate, the connection fails.
3. Warning Screen: Instead of silently loading the unencrypted site, Tor presents an alert stating “Secure Connection Not Available.”
4. User Choice: You must explicitly click a button to accept the risk and proceed to the HTTP version, or choose to go back.

Why HTTPS Warnings Are Critical in Tor

When browsing the regular web (clearnet) through the Tor network, your traffic is encrypted between your device and the Tor relay nodes. However, traffic between the final relay—known as the exit node—and the destination website is not encrypted by Tor.

• With HTTPS: The traffic between the exit node and the website is encrypted with TLS. The exit node operator cannot see your passwords, session cookies, or page content.
• Without HTTPS (Plain HTTP): The exit node operator can monitor, read, and even modify the data you send and receive (e.g., injecting malicious scripts or intercepting login credentials).

Because of this vulnerability, the warning alert serves as a vital safeguard to prevent accidental exposure of sensitive data to exit node operators.

How .onion Sites Differ

The rules are slightly different for Tor Onion Services (addresses ending in .onion):

• Native End-to-End Encryption: Onion services use Tor’s internal routing protocol, which encrypts traffic directly from the user to the host without relying on exit nodes.
• No Mandatory HTTPS Warning: Because .onion connections are already cryptographically secured and end-to-end encrypted by design, Tor Browser does not require them to have an HTTPS certificate to protect your data.

Managing HTTPS Settings in Tor Browser

You can check or customize these warning settings directly within the browser:

1. Open Settings from the main menu.
2. Select Privacy & Security from the left-hand menu.
3. Scroll to the HTTPS-Only Mode section.
4. Choose whether to enable HTTPS-Only Mode in all windows, enable it only in private windows, or disable it entirely (not recommended).