Transport Security

Force HTTPS redirects any plain HTTP request to its encrypted equivalent, so nothing is served over an unencrypted connection.

Where to find it

Architect Panel → Configuration:

• Site Settings — Force HTTPS

Architect Panel → Security:

• Certificates — the certificates that serve it

Why it is not optional

Without it, a session cookie or a password can be read by anybody positioned between the user and the server — a shared wireless network is enough. Encryption at rest and careful permissions protect nothing if the credentials travel in clear text.

It also affects things that are easy to overlook: browsers withhold features from insecure pages, and search engines treat plain HTTP as a negative signal.

What forcing it does

A request arriving over HTTP is redirected to HTTPS rather than served. That closes the accidental case — a bookmarked link, an old reference, a typed address — where somebody would otherwise be served over an unencrypted connection without noticing.

The redirect is not the whole story

The first request still leaves the browser unencrypted before being redirected. That window is small, and it is closed properly by strict transport security at the web server, which tells browsers never to attempt HTTP for your domain again.

If you are securing a site properly, set both. Forcing the redirect is the platform's part; the transport policy is your web server's.

Check for mixed content

Once forced, look for anything the pages load over HTTP — an image, a script, a stylesheet from an old integration. Browsers block or warn on these, and the symptom is usually a component that silently stops working rather than an obvious error.

Certificates expire

An expired certificate takes the site down for everybody, on a date known well in advance. Automate renewal if you can, and diary it if you cannot. This is among the most common and most avoidable outages there is.

Check integrations after enabling

Anything calling in over HTTP will be redirected, and some clients do not follow redirects — particularly older ones and simple scripts. Give integration owners notice, and check the API log after switching for callers that suddenly stop.

Turn it on everywhere

Including development and test environments. Differences between environments produce problems that appear only in production, and a test environment on plain HTTP will not surface mixed-content issues before they matter.

Worked example

An organisation enables Force HTTPS, then reviews the API log over the following week. One partner integration had been calling over HTTP with a client that did not follow redirects; it is fixed within a day. A dashboard loading a chart image from an old HTTP address is also found and corrected — both caught because somebody looked rather than assuming.

Recommendations

• Force HTTPS on every environment.
• Add strict transport security at the web server as well.
• Automate certificate renewal.
• Check the API log for callers that stop after enabling.