Group
  • Security

    Enforce HTTPS everywhere

    Redirects HTTP to HTTPS, enables HSTS, and removes mixed-content and insecure links.

    • Improve quality
    • Plan & validate
    • Beginner
    • Replit
    • Bolt
    • Lovable
    • General

Free Prompt

Make sure my app is HTTPS-only in production. Check my hosting config, framework settings, and templates. Apply: all HTTP requests redirect to HTTPS (at the host/CDN level if available, app level otherwise); HSTS is enabled with a sensible max-age (start with a day, raise toward a year once confirmed working, and only add preload after deliberate testing since it's a long-term commitment); no mixed content (every script, stylesheet, image, font, and API call in my templates uses HTTPS or relative URLs, not http:// absolute URLs); and cookies carry the Secure flag so they never travel over plain connections. Do not break local development over HTTP; gate the redirects and HSTS on the production environment. If my host terminates TLS at a proxy, make sure the app trusts the proxy headers correctly so redirects don't loop. Deliver: the redirect and HSTS setup, a list of any insecure resource references found and fixed, and verification steps: an http:// URL that redirects, the Strict-Transport-Security header present in a production response, and a browser check showing no mixed-content warnings.

What This Does / How This Helps

Makes your app HTTPS-only: redirects, HSTS, secure cookies, and no http:// resources hiding in templates. Plain HTTP traffic is readable and modifiable by anyone on the network path, which on public wifi means anyone. Session cookies riding an insecure request is exactly how accounts get hijacked in coffee shops. Mixed content is the quieter version: one http:// script tag and a network attacker owns your page even on an HTTPS site. The prompt handles the two traps: preload is flagged as a real commitment rather than a checkbox, and proxy setups get the trust-header check that prevents infinite redirect loops.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts