10047—HTTPS Content Available via HTTP

PUBLISHEDsecurity alertLow

Active

Metadata

Alert ID:: 10047
Risk:: Low
Type:: Active
CWE:: CWE-311Missing Encryption of Sensitive Data

Summary

Content which was initially accessed via HTTPS (i.e.: using SSL/TLS encryption) is also accessible via HTTP (without encryption).

Solution

Ensure that your web server, application server, load balancer, etc. is configured to only serve such content via HTTPS. Consider implementing HTTP Strict Transport Security.

Other info

ZAP attempted to connect via: http://example.org/

References

browse all alerts