---
names:
  full: Azure App Service HTTPS Only configuration is not enabled
  contextual: HTTPS Only configuration is not enabled
description: Azure Web Apps allows sites to run under both HTTP and HTTPS by default.
  Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure
  HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS
  port. It is recommended to enforce HTTPS-only traffic.
type: COMPLIANCE_POLICY
categories:
  - SECURITY
frameworkMappings:
  - "/frameworks/cis-azure-v2.1.0/09/02"
  - "/frameworks/cis-azure-v3.0.0/09/01"
  - "/frameworks/cloudaware/resource-security/data-encryption"
similarPolicies:
  internal:
    - dec-x-75db76ad
  cloudConformity:
    - url: https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/AppService/enable-https-only-traffic.html
      name: Enable HTTPS-Only Traffic
