Why does my GitHub Pages site still answer over HTTP?

Most likely because Enforce HTTPS is not ticked in the repository's Pages settings. Turning it on redirects all HTTP requests to HTTPS.

What is a GitHub Pages domain takeover?

When a domain still points at GitHub Pages but no site of yours claims it, someone else can publish there. Verifying the domain prevents it.

Where does mixed content on my Pages site come from?

From `http://` references written into the site's HTML, often in themes or old posts. GitHub's fix is to change them to `https://`.

Platforms

GitHub Pages

A site on GitHub Pages is recognisable from a `Server: GitHub.com` response header. Three settings decide most of what an audit finds there: whether Enforce HTTPS is on, so plain HTTP requests are redirected; whether the site's HTML still references assets over `http://`, which GitHub's documentation calls mixed content; and whether the custom domain is verified, which GitHub describes as protection against someone else taking the domain over.

How the engine recognises it

A `Server` header naming `GitHub.com` — weight 90, enough for a confirmed detection on its own.

The detection proves the response came from GitHub Pages. The site's generator, if any, is reported separately.

A custom domain in front changes nothing: the header is the same.

A CDN placed in front would answer instead, and GitHub Pages would then not be visible.

Enforce HTTPS

GitHub's documentation says all Pages sites, including correctly configured custom domains, support HTTPS and HTTPS enforcement.

Enforcement transparently redirects all HTTP requests to HTTPS, and is turned on by a repository administrator in the Pages settings.

A GitHub Pages site answering plain HTTP without redirecting usually has this box unticked.

The setting belongs to the repository, so it is checked there rather than in the site's files.

Mixed content in static sites

The documentation warns that a site with HTTPS enabled whose HTML still references images, CSS or JavaScript over HTTP is serving mixed content.

Its fix is to change `http://` to `https://` in the site's HTML, and it suggests searching the source files for `http://` when assets are hard to find.

Static site themes and old posts are the usual source, since the references are written into the files.

An audit lists each mixed request it finds with the page it came from.

Custom domains and takeover

GitHub explains that verifying a custom domain stops other GitHub users from taking it over to publish their own site.

Takeovers can happen when the repository is deleted, the plan is downgraded or Pages is disabled while the domain still points at GitHub Pages and is not verified.

Verification also covers the domain's immediate subdomains.

The DNS record left pointing at GitHub after a site is removed is the dangerous state; an audit sees the record and whether a site still answers.

Which checks apply

`infrastructure.hosting` and `devops.deployment_provider` report the hosting detection and its evidence.

`transport.http_redirect` and `transport.https` report whether HTTPS is enforced.

`transport.mixed_content` reports HTTP references in HTTPS pages.

`dns.cname` and `domain.subdomains` report records pointing at the platform, which is where a dangling record shows up.

Custom 404 pages and usage limits

GitHub Pages serves a custom error page when the site contains a `404.html` or `404.md` file, which GitHub documents as the way to display a custom 404.

GitHub's limits page states that published sites may be no larger than 1 GB and that source repositories have a recommended limit of 1 GB.

Sites have a soft bandwidth limit of 100 GB per month and a soft limit of 10 builds per hour, the latter not applying to sites published with a custom Actions workflow.

These limits make GitHub Pages suited to documentation and small sites, which is also the profile an audit usually finds there.

A missing page answering with GitHub's generic 404 rather than the site's own is a sign the custom page was not published at the site root.

Frequently asked questions

Why does my GitHub Pages site still answer over HTTP?: Most likely because Enforce HTTPS is not ticked in the repository's Pages settings. Turning it on redirects all HTTP requests to HTTPS.
What is a GitHub Pages domain takeover?: When a domain still points at GitHub Pages but no site of yours claims it, someone else can publish there. Verifying the domain prevents it.
Where does mixed content on my Pages site come from?: From `http://` references written into the site's HTML, often in themes or old posts. GitHub's fix is to change them to `https://`.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website