Description
In HTTP communications, traffic is not encrypted and can be captured by an attacker who has access to a network interface. This exposes sensitive information such as login credentials and personal data to eavesdropping and interception.
Recommendation
Enable HTTPS and enforce its usage to encrypt communication between clients and servers. Implement HTTP Strict Transport Security (HSTS) to instruct browsers to always use HTTPS for all future requests.
References
Could your website be exposed too?
SmartScanner can check your website for No HTTPS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Password Input on HTTP - Vulnerability
- Password Sent in HTTP Query - Vulnerability
- Password Sent Over HTTP - Vulnerability
- No Redirection from HTTP to HTTPS - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2024