ure-requests ` directive is evaluated before [ `
block-all-mixed-content ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-
Policy/block-all-mixed-content) and if it is set, the latter is effectively a
no-op. It is recommended to set either directive, but not both, unless you
want to force HTTPS on older browsers that do not force it after a redirect to
HTTP.

The ` upgrade-insecure-requests ` directive will not ensure that users
visiting your site via links on third-party sites will be upgraded to HTTPS
for the top-level navigation and thus does not replace the [ ` Strict-
Transport-Security ` ](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security)
( [ HSTS ](/en-US/docs/Glossary/HSTS) ) header, which should still be set with
an appropriate ` max-age ` to ensure that users are not subject to SSL
stripping attacks.

##  Syntax

http

    
    
    Content-Security-Policy: upgrade-insecure-requests;
    

##  Examples

###  Using the HTTP header

http

    
    
    Content-Security-Policy: upgrade-insecure-requests;
    

###  Using the HTML meta element

html

    
    
    <meta
      http-equiv="Content-Security-Policy"
      content="upgrade-insecure-requests" />
    

With the above header set on a domain example.com that wants to migrate from
HTTP to HTTPS, non-navigational insecure resource requests are automatically
upgraded (first-party as well as third-party requests).

html

    
    
    <img src="http://example.com/image.png" />
    <img src="http://not-example.com/image.png" />
    

These URLs will be rewritten before the request is made, meaning that no
insecure requests will hit the network. Note that, if the requested resource
is not actually available via HTTPS, the request will fail without any
fallback to HTTP.

html

    
    
    <img src="https://example.com/image.png" />
    <img src="https://not-example.com/image.png" />
    

Navigational upgrades to third-party resources brings a significantly higher
potential for breakage, these are not upgraded:

html

    
    
    <a href="https://example.com/">Home</a>
    <a href="http://not-example.com/">Home</a>
    

###  Finding insecure requests

With the help of the [ ` Content-Security-Policy-Report-Only ` ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only) header and the [
` report-uri ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-
uri) directive, you can set-up an enforced policy and a reported policy like
this:

http

    
    
    Content-Security-Policy: upgrade-insecure-requests; default-src https:
    Content-Security-Policy-Report-Only: default-src https:; report-uri /endpoint
    

That way, you still upgrade insecure requests on your secure site, but the
only monitoring policy is violated and reports insecure resources to your
endpoint.

##  Specifications

Specification  
---  
[ Upgrade Insecure Requests  
#  delivery  ](https://w3c.github.io/webappsec-upgrade-insecure-
requests/#delivery)  
  
##  Browser compatibility

BCD tables only load in the browser  with JavaScript enabled. Enable
JavaScript to view data.

##  See also

  * [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
  * [ ` Upgrade-Insecure-Requests ` ](/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests) header 
  * [ ` Strict-Transport-Security ` ](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) ( [ HSTS ](/en-US/docs/Glossary/HSTS) ) header 
  * [ ` block-all-mixed-content ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content)
  * [ Mixed content ](/en-US/docs/Web/Security/Mixed_content)

##  Help improve MDN

Was this page helpful to you?

Yes  No

[ Learn how to contribute
](https://github.com/mdn/content/blob/main/CONTRIBUTING.md "This will take you
to our contribution guidelines on GitHub.") .

This page was last modified on  May 10, 2023  by  [ MDN contributors ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-
requests/contributors.txt)