Headers: Upgrade-Insecure-Requests

Upgrade-Insecure-Requests header

Baseline Widely available

This feature is well established and works across many devices and browser versions. It’s been available across browsers since April 2018.

Learn more
See full compatibility

The HTTP Upgrade-Insecure-Requests request header sends a signal to the server indicating the client's preference for an encrypted and authenticated response, and that the client can successfully handle the upgrade-insecure-requests CSP directive.

Header type	Request header
Forbidden request header	No

Syntax

Upgrade-Insecure-Requests: <boolean>

Directives

<boolean>: 1 indicates 'true' and is the only valid value for this field.

Examples

Using Upgrade-Insecure-Requests

A client's request signals to the server that it supports the upgrade mechanisms of upgrade-insecure-requests:

GET / HTTP/1.1
Host: example.com
Upgrade-Insecure-Requests: 1

The server can now redirect to a secure version of the site. A Vary header can be used so that the site isn't served by caches to clients that don't support the upgrade mechanism.

Location: https://example.com/
Vary: Upgrade-Insecure-Requests

Specifications

Specification
Upgrade Insecure Requests> # preference>

Browser compatibility

	Desktop					Mobile
	Chrome	Edge	Firefox	Opera	Safari	Chrome Android	Firefox for Android	Opera Android	Safari on IOS	Samsung Internet	WebView Android	WebView on iOS
`Upgrade-Insecure-Requests`	44	17	48	31	10.1	44	48	32	10.3	4.0	44	10.3