📝 Prefer HTTPS over HTTP.

💼🚫 This rule is enabled in the ✅ recommended config. This rule is disabled in the ☑️ unopinionated config.

🔧 This rule is automatically fixable by the --fix CLI option.

Using HTTPS avoids sending URLs to public resources over an insecure protocol.

This rule checks source text, including strings, template literals, JSX, comments, and non-JavaScript files when they are linted with ESLint language plugins such as @eslint/css, @eslint/json, @eslint/markdown, and html-eslint.

URLs without a public-looking top-level domain are ignored. For example, http://localhost, http://example, and http://127.0.0.1 are allowed.

Some well-known XML identifiers are also ignored because rewriting them to https: would change their meaning.

Options

ignore

Type: Array<string | RegExp>
Default: []

Specify URLs or regular expressions to ignore. Strings must start with http:// and match the complete recognized URL exactly. Regular expressions match the same text, so use ^ and $ for a full match. They are tested from lastIndex = 0, without carrying state between URLs.

'unicorn/prefer-https': [
	'error',
	{
		ignore: [
			'http://example.com/identifier/value',
			/^http:\/\/schemas\.example\.com\//v,
		],
	},
]

Examples

// ❌
const url = 'http://sindresorhus.com';
// ✅
const url = 'https://sindresorhus.com';

// ❌
// See http://sindresorhus.com
// ✅
// See https://sindresorhus.com

// ❌
const element = <a href="http://sindresorhus.com">http://sindresorhus.com</a>;
// ✅
const element = <a href="https://sindresorhus.com">https://sindresorhus.com</a>;