GoogleChrome / lighthouse

Automated auditing, performance metrics, and best practices for the web.

https://developer.chrome.com/docs/lighthouse/overview/

Apache License 2.0

28.4k stars 9.38k forks source link

Points removed for HTTPS on HSTS TLDs #11929

Open DeJayDev opened 3 years ago

DeJayDev commented 3 years ago

Provide the steps to reproduce

Run LH on http://dejay.dev

What is the current behavior?

Lighthouse removes points for "Does not use HTTPS" even though the domain physically cannot NOT be https.

Every .dev domain is on the HSTS preload list, which makes HTTPS required on all connections. That means built-in security for you and your customers.

What is the expected behavior?

Points are not removed for this reason.

Environment Information

Affected Channels: https://web.dev/measure/
Lighthouse version: 6.3.0

Related issues

11455

Notes I don't use Chrome, I don't have a chrome/node.js version so I've removed those from the above Environment Information.

patrickhulce commented 3 years ago

Thanks for filing @DeJayDev! This is wild, PSI appears to audit an HTTP version of .dev domains somehow... We'll have to look into it.

The usual "your site redirected" note appears outside of PSI, which is a separate issue that should also be addressed at some point for these HTTPS-only domains but currently WAI.