HTTPS hack by default