Agent skill

Https Downgrade

by thedaviddias in thedaviddias/Front-End-Checklist

A skill your agent uses when auditing a site's internal and external links for protocol consistency, migrating a site from HTTP to HTTPS, or reviewing hardcoded URLs in a codebase that may use…

MITAuto-check passed

Install Https Downgrade

skills CLI
$ npx skills add thedaviddias/Front-End-Checklist --skill https-downgrade -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install thedaviddias/Front-End-Checklist https-downgrade --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/thedaviddias/Front-End-Checklist.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/https-downgrade .claude/skills/https-downgrade && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
https-downgrade
GitHub stars
74k
Token cost
~804 tokens
SKILL.md length
404 words
Files
2 (incl. references)
Skills in repo
390
Repo updated
First seen
Licence
MIT

At a glance

A skill your agent uses when auditing a site's internal and external links for protocol consistency, migrating a site from HTTP to HTTPS, or reviewing hardcoded URLs in a codebase that may use…

  • Works in 7 steps: Audit all values in templates and… → For internal links: change… → For external links: check if the… → …
  • Auditing a sites internal and external links for protocol consistency
  • SKILL.md covers Quick Reference, Check, Fix and Explain, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Https Downgrade is an agent skill from thedaviddias/Front-End-Checklist. Use when auditing a site's internal and external links for protocol consistency, migrating a site from HTTP to HTTPS, or reviewing hardcoded URLs in a codebase that may use http:// instead of https://.

Its SKILL.md is about 800 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/rule.md`).

The repository describes itself as: 🗂 The essential checklist for modern web development, for humans and AI agents. The licence is MIT.

When your agent uses it

  • Auditing a sites internal and external links for protocol consistency
  • Migrating a site from HTTP to HTTPS
  • Reviewing hardcoded URLs in a codebase that may use http:// instead of https://

Example prompts

  • “/https-downgrade”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Audit all values in templates and content for http://` links.
  2. For internal links: change http://yourdomain.com/path to /path (relative) or https://yourdomain.com/path.
  3. For external links: check if the destination supports HTTPS; update to https:// if so.
  4. For resource links (scripts, styles, images): always use https:// or protocol-relative //.
  5. In your CMS or database: run a search-and-replace to update stored HTTP URLs to HTTPS.
  6. Set up a server-level redirect from HTTP to HTTPS to catch any remaining HTTP URLs in user-generated content.
  7. Verify with: grep -r 'href="http://' ./templates/ or use a link auditing tool.

What it can do on your machine

Read from SKILL.md and the folder at commit e8d14d0. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • frontendchecklist.io

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Https Downgrade loads about 804 tokens when it runs, and up to ~2k if it reads all its reference files. Until then it costs about 55 tokens; SKILL.md has 404 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~55
When it runs · the whole SKILL.md, loaded when a task matches
~804
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from thedaviddias/Front-End-Checklist at commit e8d14d0, republished under its MIT licence (© thedaviddias). 404 words, ~804 tokens.

Download SKILL.mdSave it as .claude/skills/https-downgrade/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
https-downgrade
description
Use when auditing a site's internal and external links for protocol consistency, migrating a site from HTTP to HTTPS, or reviewing hardcoded URLs in a codebase that may use `http://` instead of `https://`.
metadata.category
seo
metadata.priority
medium
metadata.difficulty
intermediate
metadata.estimatedTime
10
metadata.source
frontendchecklist.io
metadata.url
https://frontendchecklist.io/rules/seo/https-downgrade

Linking from a secure HTTPS page to an HTTP destination creates a mixed content situation that browsers warn users about or block entirely. It also means the linked page does not receive the ranking signal passed through the HTTPS referrer. For internal links, it can cause redirect loops or broken navigation.

Quick Reference

  • All internal links on an HTTPS page must point to HTTPS URLs — HTTP links trigger mixed content warnings
  • External links to HTTP destinations break the security chain and may be blocked by browsers
  • Use protocol-relative URLs (//example.com) or absolute HTTPS URLs — never hardcode http:// for internal links

Check

On pages served over HTTPS, scan all <a href> attributes for URLs starting with http:// (not https://). Flag: (1) Internal links using http:// that should use https:// or a relative path. (2) External links to third-party sites still on HTTP (flag for review — the destination may not support HTTPS). (3) Resource links (<img src>, <script src>, <link href>) pointing to HTTP URLs — these cause active mixed content warnings.

Fix

  1. Audit all <a href> values in templates and content for http:// links.
  2. For internal links: change http://yourdomain.com/path to /path (relative) or https://yourdomain.com/path.
  3. For external links: check if the destination supports HTTPS; update to https:// if so.
  4. For resource links (scripts, styles, images): always use https:// or protocol-relative //.
  5. In your CMS or database: run a search-and-replace to update stored HTTP URLs to HTTPS.
  6. Set up a server-level redirect from HTTP to HTTPS to catch any remaining HTTP URLs in user-generated content.
  7. Verify with: grep -r 'href="http://' ./templates/ or use a link auditing tool.
Show full SKILL.md (128 more words)Show less

Explain

HTTPS is a confirmed Google ranking factor. When an HTTPS page links to HTTP resources or destinations, it downgrades the secure context, triggering browser warnings and potentially blocking content. For internal links, HTTP destinations mean an extra redirect (HTTP→HTTPS) on every navigation, slowing page loads. The ranking signal passed via the link's referrer is also diminished when crossing from HTTPS to HTTP.

Code Review

Parse all <a href>, <img src>, <script src>, and <link href> attributes. Flag any value starting with http:// (not https:// or a relative path). In JavaScript frameworks, also check for http:// in fetch(), axios, or router navigation calls. Report the count of HTTP links by category (internal, external, resource).


For full implementation details, code examples, and framework-specific guidance, see references/rule.md.

Rule page: https://frontendchecklist.io/rules/seo/https-downgrade

© thedaviddias, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/https-downgrade of thedaviddias/Front-End-Checklist.

  • SKILL.md
  • references/rule.md

Open the folder on GitHubat commit e8d14d0

Compare with similar skills

Https Downgrade next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Https Downgrade compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Https Downgrade this skillthedaviddias/Front-End-Checklist74k—~804Automated safety check: PassMIT
SEO Aeo Internal Linkingsickn33/agentic-awesome-skills47k1 repos~2.3kAutomated safety check: PassMIT
Internal Linkskostja94/marketing-skills1k—~854Automated safety check: PassMIT
Qms Audit Expertdavila7/claude-code-templates32k1 repos~2.7kAutomated safety check: PassMIT
Isms Audit Expertdavila7/claude-code-templates32k1 repos~3.1kAutomated safety check: PassMIT
Production Auditaffaan-m/ECC274k1 repos~1.9kAutomated safety check: PassMIT

Similar skills

  • SEO Aeo Internal Linking

    sickn33/agentic-awesome-skills

    Maps internal link opportunities between pages with relevant anchor text, placement instructions, orphan-page detection, and cannibalisation checks.

    47k GitHub starsUsed in 1 repo~2.3k tokens
    Marketing & SEOAuto-check passed
  • Internal Links

    kostja94/marketing-skills

    When the user wants to optimize internal linking, fix orphan pages, or improve link structure.

    1k GitHub stars~854 tokensUpdated yesterday
    Marketing & SEOAuto-check passed
  • Qms Audit Expert

    davila7/claude-code-templates

    Senior QMS Audit Expert for internal and external quality management system auditing.

    32k GitHub starsUsed in 1 repo~2.7k tokens
    Legal & ComplianceAuto-check passed
  • Isms Audit Expert

    davila7/claude-code-templates

    Senior ISMS Audit Expert for internal and external information security management system auditing.

    32k GitHub starsUsed in 1 repo~3.1k tokens
    SecurityAuto-check passed
  • Production Audit

    affaan-m/ECC

    Local-evidence production readiness audit for shipped apps, pre-launch reviews, post-merge checks, and "what breaks in prod?" questions without sending repo data to an external audit service.

    274k GitHub starsUsed in 1 repo~1.9k tokens
    Product & Project ManagementAuto-check passed
  • Omh Internal Audit

    rlaope/oh-my-hermes

    [omh] Testing an internal control -- SOX, ICFR or ITGC: define the population and the sample, name the evidence that proves each item, re-perform the control, and grade any deficiency from stated…

    3.2k GitHub stars~2.4k tokensUpdated today
    Legal & ComplianceAuto-check passed

More from thedaviddias/Front-End-Checklist

All 390 skills in this repo
  • Content Dates Audit

    thedaviddias/Front-End-Checklist

    Audits article and blog pages for visible publish dates, Article JSON-LD with datePublished and dateModified, and Open Graph time tags, then fixes what is missing.

    74k GitHub stars~691 tokensUpdated yesterday
    Auto-check passed
  • FAQPage Schema Markup

    thedaviddias/Front-End-Checklist

    Adds, checks and fixes FAQPage JSON-LD on pages with visible question-and-answer sections so it matches what readers see and can qualify for rich results.

    74k GitHub stars~774 tokensUpdated yesterday
    Auto-check passed
  • Favicon Audit and Setup

    thedaviddias/Front-End-Checklist

    Checks that a site's favicon is linked, reachable and large enough for Google search results, and sets up ICO, SVG and Apple touch icon files when they are missing.

    74k GitHub stars~731 tokensUpdated yesterday
    Auto-check passed
  • Content Freshness Signals

    thedaviddias/Front-End-Checklist

    Audits article pages for freshness signals, covering the Last-Modified header, Article JSON-LD dateModified and a visible last-updated date, and fixes mismatches.

    74k GitHub stars~741 tokensUpdated yesterday
    Auto-check passed
  • Geo Meta Tags Audit

    thedaviddias/Front-End-Checklist

    Audits and fixes geo.region, geo.placename and geo.position meta tags on regional pages, noting where they help (Bing) and where they do not (Google).

    74k GitHub stars~763 tokensUpdated yesterday
    Auto-check passed
  • Improve a Front-End Checklist Rule

    thedaviddias/Front-End-Checklist

    Scores and rewrites a Front-End Checklist rule MDX file against a scored quality rubric, replacing generic stub prompts with specific, actionable ones.

    74k GitHub stars~1.3k tokensUpdated yesterday
    Auto-check passed

Questions about Https Downgrade

What does Https Downgrade do?

A skill your agent uses when auditing a site's internal and external links for protocol consistency, migrating a site from HTTP to HTTPS, or reviewing hardcoded URLs in a codebase that may use…. Https Downgrade is an agent skill from thedaviddias/Front-End-Checklist. Use when auditing a site's internal and external links for protocol consistency, migrating a site from HTTP to HTTPS, or reviewing hardcoded URLs in a codebase that may use http:// instead of https://.

When should I use Https Downgrade?

Https Downgrade fits situations like: auditing a sites internal and external links for protocol consistency; migrating a site from HTTP to HTTPS; reviewing hardcoded URLs in a codebase that may use http:// instead of https://.

How do I install Https Downgrade in Claude Code?

Run `npx skills add thedaviddias/Front-End-Checklist --skill https-downgrade -a claude-code`. Or copy the skill folder (skills/https-downgrade in thedaviddias/Front-End-Checklist) into .claude/skills/https-downgrade in your project. Claude Code loads it when a task matches its description.

How do I install Https Downgrade in Codex?

Run `npx skills add thedaviddias/Front-End-Checklist --skill https-downgrade -a codex`. Or copy the skill folder (skills/https-downgrade in thedaviddias/Front-End-Checklist) into .agents/skills/https-downgrade in your project. Codex loads it when a task matches its description.

Can I use Https Downgrade in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add thedaviddias/Front-End-Checklist --skill https-downgrade -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/https-downgrade, .gemini/skills/https-downgrade, .github/skills/https-downgrade and .opencode/skills/https-downgrade in your project.

What does Https Downgrade need to run?

SKILL.md names no scripts, command-line tools or credentials: Https Downgrade is instructions for the agent only.

Does Https Downgrade access the network?

SKILL.md names 1 domain. As links in the text: frontendchecklist.io. This is read from the text; nothing was executed.

Is Https Downgrade safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Https Downgrade use?

Https Downgrade is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Https Downgrade use?

About 804 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.2k tokens, read only when the agent opens those files.

What are the alternatives to Https Downgrade?

Skills that share tags, products or a category with Https Downgrade: SEO Aeo Internal Linking (sickn33/agentic-awesome-skills, 47k stars), Internal Links (kostja94/marketing-skills, 1k stars), Qms Audit Expert (davila7/claude-code-templates, 32k stars) and Isms Audit Expert (davila7/claude-code-templates, 32k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Https Downgrade?

thedaviddias (a GitHub user) maintains it in thedaviddias/Front-End-Checklist, which has 74,388 GitHub stars. The repository holds 390 skills in this directory. The repository was last updated on October 6, 2026.

Source: thedaviddias/Front-End-Checklist on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.