Handle a Firefox HTTPS-Only warning without exposing a login

HTTPS-Only Mode tries to upgrade a website connection from HTTP to encrypted HTTPS. If the site cannot provide HTTPS, Firefox warns before allowing the insecure version. A router's local management page or old internal device may be a deliberate exception, but a financial or account login should not be casually opened over HTTP. Diagnose the destination and use a temporary, exact-site exception only when the risk is understood.

Before you start​

Read the full domain or local IP address. Do not assume a padlock-shaped icon or familiar logo proves the page belongs to a real service. Avoid entering a password on an HTTP page over public Wi-Fi. For a router, use your own local network and its official manual.

Do it step by step​

1. Check whether the site has an HTTPS address by navigating independently to its known official URL. A typo or redirected phishing page can produce an HTTP warning too.
2. If it is a device page, confirm the address against its manual or label and verify you are on your own network. Try the manufacturer's documented HTTPS address or firmware update before allowing HTTP.
3. In Firefox Settings, Privacy & Security, inspect HTTPS-Only Mode. For a necessary site, use Manage Exceptions or the site information panel and enter the exact address. Prefer a temporary exception for a one-time maintenance task.
4. Reload and observe whether the address begins with http://. If it does, treat the connection as unencrypted. Do not submit reusable credentials, payment details or personal documents unless there is no safer supported path and you fully control the network.
5. Complete the limited local task, then remove the temporary exception or verify its expiry. Recheck whether the device can enable HTTPS or receive an update.
6. If the warning is for a public account site, stop. Contact the provider through an independently verified channel instead of making an exception to reach a sign-in page.

Check the result​

The genuine destination is identified, the exception is limited or removed, and no sensitive account data was sent over an unnecessary HTTP connection.

If something goes wrong​

If HTTPS fails due to a captive portal, complete the network's legitimate sign-in separately, then revisit the target over HTTPS. If a certificate warning appears, that is a different problem; an HTTPS-Only exception does not validate an untrusted certificate.

Know the limit​

HTTPS protects transport to the site, not the site's honesty. HTTP can expose or alter traffic on the path. Firefox exceptions may be temporary or persistent, and private windows have different limits; read the current browser prompt rather than relying on an old screenshot. Mozilla HTTPS-Only Mode and exceptions