Hypertext Transfer Protocol Secure (HTTPS)

The site uses HTTPS to encrypt data between the server and users.

Impact

About

Hypertext Transfer Protocol Secure (HTTPS) is the strongest privacy and integrity protection currently available for public web connections. HTTPS ensures users that their privacy is protected when visiting a government website.

HTTPS is indicated by a lock icon and/or https:// in the browser bar.

Risks

Hackers can see and steal personal information.

Why it's important

Secures data by encrypting communication, protecting user privacy and preventing unauthorized access to sensitive information during online interactions.

User stories

As a site visitor, I want the website to use HTTPS so that my data is encrypted and protected from interception or tampering while browsing or submitting information.

Code

nginx redirect HTTP to HTTPS:

server {
  listen 80;
  server_name example.gov www.example.gov;
  return 301 https://$host$request_uri;
}

Error

ScanGov messaging when a site fails a standard:

Site is not served over HTTPS.

Examples

Example government websites with HTTPS:

Guidance

U.S. Federal Website Standards

Indicators

Security