Opens in a new tabSkip to content
Agent LighthouseAgent Lighthouse

    Searches the text of every published page. The evidence sources themselves are not in this index — search all of them on the trusted sources page.

    GitHub ↗
    Browse checks and page contents
    access-crawl-control/https-enabled

    HTTPS enabled

    What it checks

    Whether the site is served over HTTPS.

    State Result
    the scanned URL uses plain http:// fail, priority high
    HTTPS, and the homepage returned a document pass
    HTTPS, and the homepage answered with no document warn, priority high

    The claim is narrow. No AI crawler vendor documents refusing plain HTTP, and GPTBot, ClaudeBot and PerplexityBot fetch http:// URLs. What is documented is that Chrome, since version 154, asks before it opens a public site over plain http.

    Why it matters

    Since Chrome 154, released on 2026-09-22, Chrome prompts by default when it connects to a site over plain http. An agent that works inside a Chrome tab, such as Gemini in Chrome or Claude in Chrome, meets that prompt on a first visit before any page content. No agent vendor documents how its agent handles the prompt.

    Evidence

    HTTPS requirement

    The Chrome 154 release notes say: “Ask before HTTP on by default. Chrome prompts users by default when they connect to a site over an insecure ( http ) connection.” The stable release date is September 22, 2026 — developer.chrome.com/…/154 (verified 2026-10-18). The Chrome Security Team’s announcement of 2025-10-28 says Chrome “will ask for the user’s permission before the first access to any public site without HTTPS”. The prompt covers public sites only, is not repeated for sites a user visits regularly, and can be bypassed — blog.google/…/https-by-defau (verified 2026-10-18).

    Limits

    The crawler documentation of OpenAI (developers.openai.com/…/bots), Anthropic (support.claude.com/…/8896518-does-anthropic-crawl-d…) and Perplexity (docs.perplexity.ai/…/perplexity-crawlers) says nothing about HTTPS or TLS (all verified 2026-10-18). Google’s AI features have “no additional technical requirements” beyond Search eligibility, and HTTPS is not mentioned — developers.google.com/…/ai-features (verified 2026-10-18). No agent vendor documents what its agent does at Chrome’s prompt, and nothing documents that Chromium-based browsers other than Chrome adopted the default. MCP requires HTTPS only for its optional authorization server endpoints and redirect URIs, not for the site — modelcontextprotocol.io/…/authorization (verified 2026-10-18).

    The audit reads only the scheme of the scanned base URL: it does not check the certificate chain, HSTS, or an HTTP-to-HTTPS redirect, and agent-protocol endpoints have their own HTTPS rules that belong in the audits that read them.

    How it scores

    Scored (weight 0.6), ternary. A plain-http base URL fails at priority high, not critical: the documented cost is a prompt the user can bypass, not an outage.

    Grade: B — one documented, shipped, default-on behaviour of a named user agent: Chrome 154 prompts before opening a public plain-http site — developer.chrome.com/…/154 (verified 2026-10-18). An agent working inside Chrome meets that prompt; that step is an inference, because no agent vendor documents it. It is not A: no AI vendor states that its agent or crawler treats HTTPS differently. If the step from Chrome to the agents inside it is rejected, the grade falls to C.

    Sources