Questions and Caveats

Sadly, many sites still include a lot of content from third party domains that is not available over HTTPS. As always, if the browser's lock icon is crossed out or displays a "not secure" label, you may remain vulnerable to some adversaries that use active attacks or traffic analysis. However, the effort that would be required to eavesdrop on your browsing should still be usefully increased. Answers to common questions may be on the frequently asked questions page. HTTPS Everywhere can protect you only when you're using sites that support HTTPS and for which HTTPS Everywhere include a ruleset. If sites you use don't support HTTPS, ask the site operators to add it; only the site operator is able to enable HTTPS. There is more information and instruction on how server operators can do that in the EFF article How to Deploy HTTPS Correctly.

Development And Writing your own Rulesets

If you'd like to write your own update channel for rulesets, you can find out how to do that here. Information about how to access the project's Git repository and get involved in development is here. Send feedback on this project to the https-everywhere AT eff.org mailing list or our Github discussions forum. Note that this is a public and publicly-archived mailing list. You can also subscribe. Send fixes to existing rewrite rules to the https-everywhere-rules AT eff.org mailing list or submit an issue with an existing ruleset on our Github repository. Note that this is a public and publicly-archived mailing list. You can also subscribe.