I use HTTPS Everywhere in Firefox, but it only enforces HTTPS for a very limited set of very well-known sites (by default).

I use a wide variety of much smaller sites which do have HTTPS versions, but when going to HTTP they don't automatically enforce their HTTPS (let alone have HSTS), so unless I specifically remember to type in HTTPS (and/or add all their domains to the whitelist in HTTPS Everywhere), I am time and time again using non-secure versions of websites that I easily could be automatically using the secure version thanks to some ingenius Firefox add-on or userscript.

It may introduce a slight usability handicap, but I would like to try out the concept for the sake of potentially much, much greater privacy from wiretapping snoopers listening in on the Internet. (such as my VPN, my ISP, or other nefarious parties like NSA.)

It could even just be a very simple Greasemonkey script. I would imagine it would go:

  • Force every page to change http to https in the URL, if not already https.
  • If https page loads normally with standard HTTP response, do nothing (mission accomplished).
  • If https page fails to load, revert back to http and add domain as an @exclude entry in the script (or another elegant way of making a 'blacklist' in the script) so an attempt isn't made again.

I would not know how to code that though.

As an awesome bonus, it could introduce a button / notification that says 'Boo, this site doesn't exist in HTTPS!' to remind me when I'm currently on an 'insecure' site so that maybe I can start using those sites less and stick to the ones that I know can't be snooped on as near as much, instead.

And BTW, as for (bad) certificate (trust) issues: I'd rather still automatically use a cert a site uses, and do a second step of verification if I'm going to actually log into it, rather than automatically going to NON secure version of countless lazily-configured sites without realising it.


There's a related question on SO: How to replace http links to https in whole page using Greasemonkey? But that would only satisfy your first condition. The NoScript addon to Firefox seemingly also has the possibility to enforce https – but here you have to configure the site list manually.

While these two are not satisfying all your conditions, my research brought up an interesting article at Geeks.IM, titled How to Redirect from HTTP to HTTPS Automatically in Firefox, which recommends HTTPS Finder for this purpose:

HTTPS Finder sends a small HTTPS request to each HTTP page you browse to, when it detects a SSL connection, it will enforce the HTTPS connection at once. You can let it alert you when it has detected such a more secure connection or forward to HTTPS automatically.

Which seems to be exactly what you want. To give you some visuals:

HTTPS Finder Preferences
HTTPS Finder Preferences (source: Geeks.IM; click image for larger variant)

As you can see in the "Session discovery results", this addon even gives you the additional benefit of seeing how secure that https really is when it comes to "secondary data" as cookies, which you want to make sure to protect (thinking of your session IDs).

As HTTPS Finder has been removed from the Mozilla Addons site, you can find the .xpi in the download section of the project. Unfortunately, it looks like this addon is no longer maintained (last version listed is from 12/2013), so I cannot tell you whether it's still compatible (or can be made working) with recent versions of Firefox.1


An addon taking the exact opposite approach is HTTP Nowhere, whose main feature is to block all HTTP urls you visit, but which also has an option in its settings: 'Always try HTTPS instead of blocking'. So this would avoid unsecured browsing altogether: Either it finds a secured variant, or it will keep you from accessing the URL you requested. The OP tried it, and it works well, and even if admittedly it has a major (unturnoffable) feature (HTTP blocking) which isn't technically in the scope of the original question, it's the one he decided to go with and it works great with both whitelisting and blacklisting, both ways.

HTTP Nowhere Prefs
HTTP Nowhere preferences (click image for larger variant)

Though this addon is still available at AMO, it's not clear whether it's still actively maintained either: with its last version dated 9/2013, it's even older.

1: as the OP points out: just double checked what you had found, I'd say it doesn't fit the bill as it looks like it 'checks' for HTTPS instead of FORCING it (then seeing if it works), and I think, only after loading the whole HTTP page. To me this seems partly true insofar as it sticks to the http URL *when no https was found for it. The linked article states: You can let it alert you when it has detected such a more secure connection or forward to HTTPS automatically.
2: as requested by the OP with information he provided

  • 1
    HTTPS everywhere (at least as of now) also has the same block all HTTP traffic option.
    – Enigma
    Apr 9 '15 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy