All rules

Sheath rule

security-prefer-https

URLs should use HTTPS instead of HTTP.
Package
Core
Category
Security
Default severity
warning by default
Auto-fix
Auto-fix available

(dangerous)

#Why

HTTP traffic can be read or modified in transit. HTTPS protects links and resources from interception and tampering. Browsers may also block HTTP scripts and stylesheets on HTTPS pages as mixed content.

#Examples

#Bad

<!-- HTTP URLs in various attributes -->

<a href="http://example.com">External Link</a>

<img src="http://cdn.example.com/image.jpg" alt="Photo">

<script src="http://cdn.example.com/script.js"></script>

<link href="http://fonts.example.com/font.css" rel="stylesheet">

<form action="http://api.example.com/submit" method="POST">

<a href="/" ping="http://analytics.example.com/click">Tracked link</a>



<!-- HTTP in srcset -->

<img srcset="http://cdn.example.com/small.jpg 1x,

             http://cdn.example.com/large.jpg 2x">

#Good

<!-- HTTPS URLs -->

<a href="https://example.com">External Link</a>

<img src="https://cdn.example.com/image.jpg" alt="Photo">

<script src="https://cdn.example.com/script.js"></script>

<link href="https://fonts.example.com/font.css" rel="stylesheet">

<form action="https://api.example.com/submit" method="POST">



<!-- Protocol-relative URLs (uses current page protocol) -->

<img src="//cdn.example.com/image.jpg" alt="Photo">



<!-- Relative URLs (recommended for same-origin resources) -->

<img src="/images/photo.jpg" alt="Photo">

<script src="/js/app.js"></script>



<!-- Laravel asset helpers (respects APP_URL) -->

<img src="{{ asset('images/photo.jpg') }}" alt="Photo">

<script src="{{ mix('js/app.js') }}"></script>



<!-- Loopback development hosts never leave the machine -->

<script src="http://localhost:5173/@vite/client"></script>

<img src="http://127.0.0.1:8000/img/logo.png" alt="Logo">

<a href="http://[::1]:8000/">Local</a>

#Attributes Checked

The rule checks URL-bearing attributes on these elements.

Attribute Elements Purpose
href <a>, <link>, <area> Links, stylesheets
src <script>, <img>, <audio>, <video>, <iframe> Resources
srcset <img>, <source> Responsive images
imagesrcset <link> Responsive preload images
action <form> Form submission
data <object> Embedded objects
poster <video> Video poster image
formaction <button>, <input> Button form action
cite <blockquote>, <q> Quote sources
ping <a>, <area> Space-separated hyperlink audit endpoints

#Options

Use this option to permit plain HTTP for selected development hosts.

Option Type Default Description
allowedHosts array ['localhost', '127.0.0.1', '[::1]'] Exact hosts allowed to use plain HTTP.

Host matching is exact and case-insensitive, and ports are ignored. The configured list replaces the default loopback list, so include any defaults you want to retain:

<?php



'rules' => [

    'security-prefer-https' => ['warning', [

        'allowedHosts' => ['localhost', 'myapp.test', '192.168.1.50'],

    ]],

],

#Auto-fix

The fixer replaces http:// with https://:

<!-- Before -->

<a href="http://example.com">Link</a>



<!-- After -->

<a href="https://example.com">Link</a>

The fix is dangerous and requires --dangerous, because the template alone cannot prove that the destination serves HTTPS. Verify the endpoint before applying the rewrite.

#Best Practices

  1. Use relative URLs for same-origin resources
  2. Use asset helpers like asset() or mix()
  3. Configure APP_URL with HTTPS in production
  4. Force HTTPS in your web server/load balancer

#Notes

  • Local development URLs (localhost, 127.0.0.1, [::1]) are allowed by default; set allowedHosts to [] to enforce HTTPS for them too
  • Leading and trailing ASCII whitespace allowed by HTML URL attributes is preserved when a URL is checked or fixed
  • Every static URL in a space-separated ping attribute is checked. The rule does not auto-fix ping lists
  • Ensure external services support HTTPS before changing
  • Protocol-relative URLs (//) are legacy but still work

#References

#Related Rules