---
title: "Refuse plain HTTP on the API · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/api-security/api-https-only
updated: 2026-10-20
licence: "All rights reserved"
---

# Refuse plain HTTP on the API

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [API security](https://agentwranglers.se/playbook/api-design/api-security)
- Rule: Serve the API over HTTPS only. Refuse plain HTTP calls with an error instead of redirecting them.
- How: A redirect comes too late, because the token already crossed the network in clear text. Close port 80 for the API host, or answer every HTTP request with 403. Revoke any key that arrives over plain HTTP. Set up TLS itself as the website playbook's [HTTPS rule](https://agentwranglers.se/playbook/website/hosting-and-network/https-tls) describes.
- Check: `curl -si http://api.example.com/orders` fails to connect or answers 403. It never answers 301, 302, 307 or 308.

Example:

```nginx
server {
  listen 80;
  server_name api.example.com;
  return 403;
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/api-https-only`.

- Previous: [Store API keys as hashes](https://agentwranglers.se/playbook/api-design/api-security/api-keys)
- Next: [List every API you run](https://agentwranglers.se/playbook/api-design/api-security/inventory)
- [API security](https://agentwranglers.se/playbook/api-design/api-security)