Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 157 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

In preparation for the eventual deployment of full HTTPS support on Stack Exchange, and also to make the currently available "alpha" HTTPS support more usable, all links from Stack Exchange sites to other Stack Exchange sites should be protocol-relative.

Currently, at least the following places still feature links with explicit http: protocol prefixes:

and, of course,

  • lots and lots of user-supplied links in post and comment content.

I've posted this feature request with the intent to provide a single central place for tracking these issues, rather than having them scattered across multiple meta threads. If you find more places on SE where protocol-relative links should be used, please report them below.

I fully expect this request, in its full sense, to be treated as for the time being; however, these issues do need to be fixed at some point before our HTTPS support is ready for "prime time".

Ps. Yes, the next release of SOUP (v1.10) is going to include a general client-side fix for most of these issues. In the mean time, the HTTPS Everywhere plugin effectively provides the same functionality, and much more besides.

share|improve this question
@random: Yes, that would be nice too, and arguably higher priority than this. It's a slightly different issue, though. (This one's about clickable hyperlinks, the one you linked to is about inline images.) – Ilmari Karonen Mar 1 '14 at 14:24

As planned, version 1.10 of the Stack Overflow Unofficial Patch now contains a client-side implementation of this feature.

Specifically, it works by finding all links on the page that use the http: protocol and point to a Stack Exchange site, and rewriting them to use https: instead.

Some notes about the implementation:

  • This feature is only enabled if you're already looking at the page over HTTPS. It will not force you to use HTTPS if you don't want to. (Also, if you accidentally switch to plain HTTP, SOUP will not alert you or redirect you to HTTPS. If you want that, use HTTPS Everywhere.)

  • Links to chat, Area 51 and the SE blog are currently excluded, since those sites still load much of their JS and CSS over HTTP, and thus work very poorly, if at all, over HTTPS.

  • SOUP does not run on non-SE sites, and thus cannot rewrite links to SE from other sites. Also, if you're, say, using SE chat over plain HTTP, any links there will not get rewritten.

  • Obviously, the rewrite also does not apply to things that are not ordinary links, such as form actions or JavaScript pseudo-links. Fortunately, most of those seem to be using relative URLs already.

  • To work around a known bug with permalink URLs, any such URLs are rewritten to a slightly longer form (/q/ and /a/ become /questions/, and /u/ becomes /users/). This fix is currently only applied to permalink URLs that use the http: protocol; any permalink URLs already using the https: protocol (or no protocol at all) will not be fixed, and so will redirect you to an HTTP URL if followed.

  • For the curious, the code of the user script includes the following line:

    //css:  "a.soup-https-fixed:not(#specificity-hack) { color: green !important }", // uncomment to highlight affected links

    Uncommenting it (by removing the // in front of css:) causes all rewritten links to be colored green. You can also achieve the same effect by installing the CSS rule shown on the line as a user style.

In general, this feature of SOUP should not be considered an adequate replacement for HTTPS Everywhere; even with the URL rewrites, it's still all too easy to accidentally switch from HTTPS to plain insecure HTTP. Still, if you just want to occasionally try using Stack Exchange over HTTPS (e.g. to see how well / badly it works), this fix does make it a lot easier to stay in HTTPS mode.

Note (December 2015): As of SOUP v1.42, this fix is no longer applied to links to per-site metas (meta.*, since, alas, those don't currently work over HTTPS. Hopefully, we'll eventually get proper support for HTTPS on meta sites again, but until then, this part of the fix was doing more harm than good.

share|improve this answer
Why does this require users to install a script? Why can't the site do this when generating HTML? (so that everybody benefits) And why does it replace explicit HTTP with explicit HTTPS? Wouldn't it be kinder to leave the protocol unspecified? (And yes, I happily use HTTPS Everywhere, but I'd like SE to be the best for *all users). – Toby Speight Mar 11 at 11:14
@TobySpeight Yes, it would be far better to do this on the server. I'm not a Stack Exchange employee, though, and don't have access to the SE servers or the code they run, so this unofficial user script is the best I can do. – Ilmari Karonen Mar 11 at 11:39
@TobySpeight (And yes, if done on the server, using protocol-relative URLs would be best. For the script it makes no difference, since it only applies the replacement when the page is loaded over HTTPS anyway.) – Ilmari Karonen Mar 11 at 11:44

Site switcher on is not protocol-relative

Links to other Stack Exchange sites in Site Switcher is protocol-relative when we are on a particular SE site or on MSE. But when we are specifically on the site switcher links to the http version of all the sites. The links over there should also be protocol relative.

Site switcher on is not protocol-relative

share|improve this answer

Hot Network Questions is still explicitly HTTP

Extract from the end of "Related" and start of "Hot Network Qs":

<div class="spacer js-gps-track">
<a href="" title="Vote score (upvotes - downvotes)">
    <div class="answer-votes default">6
</a><a href="" class="question-hyperlink">Broken links to per-site metas</a>


<div id="hot-network-questions" class="module">
        <a href="//" class="js-gps-track" data-gps-track="{ item_type:1, location:11 })">
            Hot Network Questions
                <div class="favicon favicon-rpg" title="Role-playing Games Stack Exchange"></div><a href="" class="js-gps-track" data-gps-track="site.switch({ item_type:11, target_site:122 });{ item_type:2, location:11 })">
                    What is the probability of surviving my death saves?


Only the "Hot Network Questions" link itself (in the H4) is protocol-relative. The actual question links are explicitly HTTP.

Interestingly, the related-question links seem to be explicitly HTTPS!

share|improve this answer
This is not a bug list. If you have a problem, please ask a new question. – Patrick Hofman Mar 11 at 11:27
@PatrickHofman I did ask people to post here if they find any new places with explicit http: links, so this is technically a valid answer. (Whether SE staff would prefer to have such reports collected here, or individually posted as separate bug reports / feature reqs, is something I have no specific knowledge of.) – Ilmari Karonen Mar 11 at 11:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .