When to use HTTPS for local development

Using http://localhost for local development is fine most of the time, except in some special cases. This post explains when you need to run your local development site with HTTPS.

Maud Nalpas

Also see: How to use HTTPS for local development.

In this post, statements about localhost are valid for 127.0.0.1 and [::1] as well, since they both describe the local computer address, also called "loopback address". To keep things simple, the port number isn't specified. So when you see http://localhost, read it as http://localhost:{PORT} or http://127.0.0.1:{PORT}.

When developing locally, use http://localhost by default. Service Workers, Web Authentication API, and more work. However, in the following cases, you need HTTPS for local development:

Debugging mixed-content issues
Using HTTP/2 and later
Using third-party libraries or APIs that require HTTPS
Using a custom hostname

A list of cases when you need to use HTTPS for local development. — When to use HTTPS for local development.

If you need HTTPS for local development, check out How to use HTTPS for local development.

Why your development site should behave securely

To avoid running into unexpected issues, you want your local development site to behave as much as possible like your production website. So, if your production website uses HTTPS, you want your local development site to behave like an HTTPS site.

Use `http://localhost` by default

Browsers treat http://localhost in a special way: although it's HTTP, it mostly behaves like an HTTPS site.

On http://localhost, Service Workers, Sensor APIs, Authentication APIs, Payments, and other features that require certain security guarantees are supported and behave exactly like on an HTTPS site.