How HTTPFirst Check works

Last updated 26 October 2026

What we request

When you run a check, our server requests the homepage of four addresses: https://example.com/, https://www.example.com/, http://example.com/ and http://www.example.com/ (using your domain). We follow each redirect step ourselves, up to 7 redirects, and save nothing. If a redirect passes through a plain-HTTP address on a third-party name (such as a registrar's forwarding service), we also make one HTTPS request to that name. That's needed to tell whether Chrome can upgrade that step. We also open one TLS connection each to the bare domain and to www to read the certificate's names and dates.

That's usually 6 to 12 small requests per check, all started by you. Requests identify themselves as HTTPFirstCheck/0.1 with a link to this page. We don't crawl links, submit forms, or try to get around logins, firewalls or CAPTCHAs. Site owners who want us to stop checking their domain can email .

Safety limits

This check uses the same protections as our other Valleyfill tools. We only fetch public web addresses on ports 80 and 443. We refuse IP addresses, internal or reserved names, and any domain that resolves to a private or reserved network. Every redirect step is checked again, and each connection is pinned to the address we checked, so DNS tricks can't send us to an internal network. Each request has a timeout, the whole check has a 25-second budget, and we read at most 768 KiB of homepage HTML.

How we decide what Chrome shows

We follow the rules Google and the Chromium project publish:

• Chrome tries HTTPS first. If HTTPS works on a name, typed addresses and old http:// links are upgraded automatically.
• If HTTPS fails on a name (no certificate for that name, an expired or untrusted certificate, or nothing listening on port 443) and HTTP might work, Chrome asks before it connects over HTTP.
• This applies to every redirect step, not just the final page.
• If a link explicitly uses https:// and it fails, Chrome shows a normal error page instead.
• Sites that send HSTS are never downgraded to HTTP.

Sources (opened 26 October 2026): Google: "Chrome Now Warns Before Insecure HTTP Connections" (21 Oct 2026) · Chromium: Adapting your website for Chrome's "Ask-before-HTTP" warning.

Certificate names are matched the way browsers do it. Only the certificate's subject alternative names count. A wildcard such as *.example.com covers www.example.com but never the bare example.com.

Free daily limit

Each visitor gets 5 free checks per day. The count resets at 00:00 UTC.

Privacy

• No cookies, no analytics, no ad trackers. Nothing from third parties is loaded on these pages.
• To count your free checks, we combine your IP address with the date and a secret value, then one-way hash the result. We store only that hash and a counter, and the record is deleted automatically about a day later. We never store your raw IP address.
• We don't save the domains you check or their results.

Monitoring plan

"HTTPFirst Watch" is a planned paid monitoring service and is not available yet. Nothing on this site takes payment.