Upgrade insecure requestsBaseline · Widely available
The Upgrade-Insecure-Requests HTTP request header tells the server that the response should redirect to a secure (HTTPS) resource.
Supported in all major browsers for at least 30 months — safe to use without fallbacks. Baseline since Apr 30, 2018. Widely available since Oct 30, 2020.
Browser support
DesktopChrome
1–43Not supported
44+Supportedsince Jul 21, 2015
Current: 155Edge
12–16Not supported
17+Supportedsince Apr 30, 2018
Current: 154Firefox
1–47Not supported
48+Supportedsince Aug 2, 2016
Current: 157Safari
1–10Not supported
10.1+Supportedsince Mar 27, 2017
Current: 27MobileChrome Android
18–43Not supported
44+Supportedsince Jul 29, 2015
Current: 155Firefox Android
4–47Not supported
48+Supportedsince Aug 2, 2016
Current: 157Safari iOS
1–10Not supported
10.3+Supportedsince Mar 27, 2017
Current: 27How to use
This feature is Baseline widely available — use it freely, no fallback needed.
Example
Full syntax and examples are on MDN: upgrade-insecure-requests.
Feature detection
There’s no simple runtime check for this feature; rely on the support table and test in your target browsers.
Documentation (MDN)
Specification
Sub-features
Support for each part of the feature (2). The overall table above shows when the whole feature works.
| Sub-feature | Chrome | Edge | Firefox | Safari | Chrome Android | Firefox Android | Safari iOS |
|---|---|---|---|---|---|---|---|
| http.headers.Content-Security-Policy.upgrade-insecure-requests | 43 | 17 | 42 | 10.1 | 43 | 42 | 10.3 |
| http.headers.Upgrade-Insecure-Requests | 44 | 17 | 48 | 10.1 | 44 | 48 | 10.3 |