Upgrade-Insecure-Requests

This request header tells a server that a browser prefers an encrypted response and can handle the CSP upgrade-insecure-requests directive.

Use it as a signal alongside HTTPS deployment and CSP. It does not replace redirects or HSTS and does not upgrade requests made by every client.

httpsecurityhttpscsp

Reference (http)

Upgrade-Insecure-Requests: 1

Use it as a signal alongside HTTPS deployment and CSP. It does not replace redirects or HSTS and does not upgrade requests made by every client.

Common mistakes

Treating the header as proof that the client is a browser or as a substitute for serving HTTPS.

Sources