Questions and Caveats

Sadly, many sites still include a lot of content from third party domains that is not available over HTTPS. As always, if the browser's lock icon is broken or carries an exclamation mark, you may remain vulnerable to some adversaries that use active attacks or traffic analysis. However, the effort that would be required to eavesdrop on your browsing should still be usefully increased. Update: in recent versions of Firefox, Mozilla has removed the broken padlock indicator. Now, the only difference between a secure and insecure HTTPS deployment is the blue or green tint on the left of the address bar for secure deployments Answers to common questions may be on the frequently asked questions page. HTTPS Everywhere can protect you only when you're using sites that support HTTPS and for which HTTPS Everywhere include a ruleset. If sites you use don't support HTTPS, ask the site operators to add it; only the site operator is able to enable HTTPS. There is more information and instruction on how server operators can do that in the EFF article How to Deploy HTTPS Correctly.

Development And Writing your own Rulesets

Webmasters and prospective contributors: Check the HTTPS Everywhere Atlas to quickly see how existing HTTPS Everywhere rules affect sites you care about! HTTPS Everywhere uses small ruleset files to define which domains are redirected to https, and how. If you'd like to write your own ruleset, you can find out how to do that here. Information about how to access the project's Git repository and get involved in development is here. Send feedback on this project to the https-everywhere AT eff.org mailing list. Note that this is a public and publicly-archived mailing list. You can also subscribe. Send new rewrite rules or fixes to existing rewrite rules to the https-everywhere-rules AT eff.org mailing list. Note that this is a public and publicly-archived mailing list. You can also subscribe.