What Happened to HTTPS Everywhere in Tor Browser?

The HTTPS Everywhere extension was deprecated and removed from the Tor Browser because its core functionality is now natively built into modern browser engines. Developed by the Electronic Frontier Foundation (EFF) and the Tor Project, the extension served for over a decade to force secure encrypted connections. However, the rise of native “HTTPS-Only Mode” across major browsers made the standalone add-on redundant, leading to its complete integration directly into the Tor Browser codebase.

The Rise and Sunset of the Extension

HTTPS Everywhere was created in 2010 to protect user privacy by rewriting insecure http:// requests to secure https:// equivalents. At the time, many websites supported encryption but did not default to it. As the broader web transitioned toward HTTPS adoption, major browsers began developing integrated solutions to enforce encrypted connections without requiring third-party extensions.

In late 2021, the EFF announced that HTTPS Everywhere would be sunset by the end of 2022. Because native browser technologies had caught up to the extension’s capabilities, maintaining a separate add-on was no longer necessary.

Native HTTPS-Only Mode in Tor Browser

Starting with Tor Browser 11.5, the Tor Project completely replaced the HTTPS Everywhere extension with a native HTTPS-Only Mode inherited from Mozilla Firefox.

Instead of relying on a pre-packaged ruleset of supported websites, native HTTPS-Only Mode automatically attempts to establish an encrypted connection with every website by default. If a website does not support HTTPS, the browser halts the connection and presents a warning prompt, asking the user if they want to proceed over an unencrypted HTTP connection.

Key Benefits of Native Integration

The transition from an extension to a native feature provided several improvements:

• Better Performance and Stability: Native browser features run faster and consume fewer system resources than browser extensions.
• Universal Coverage: Rather than relying on curated lists of supported sites, the native implementation attempts encryption on all web requests, including subresources like scripts and images.
• Reduced Attack Surface: Eliminating the extension reduced the complexity of the browser codebase, improving security maintenance.

Current Status and Configuration

HTTPS-Only Mode is enabled by default in all current versions of the Tor Browser. Users can customize its behavior by navigating to Settings > Privacy & Security and scrolling down to the HTTPS-Only Mode section, where they can toggle the feature or manage exceptions for specific websites.