I made a POST request to a HTTP (non-HTTPS) site, inspected the request in Chrome&#39;s Developer Tools, and found that it added its own header before sending it to the server:

    Upgrade-Insecure-Requests: 1

After doing a search on `Upgrade-Insecure-Requests`, I can only find [information][1] about the server sending [this][2] header:

    Content-Security-Policy: upgrade-insecure-requests

This seems related, but still very different since in my case, the CLIENT is sending the header in the *Request*, whereas all the information I&#39;ve found is concerning the SERVER sending the related header in a *Response*.

---

So why is Chrome (44.0.2403.130 m) adding `Upgrade-Insecure-Requests` to my request and what does it do?

---

# Update 2016-08-24:

This header has since been added as a [W3C Candidate Recommendation][3] and is now officially recognized.

For those who just came across this question and are confused, the [excellent answer][4] by Simon East explains it well.

The `Upgrade-Insecure-Requests: 1` header used to be `HTTPS: 1` [in the previous W3C Working Draft][5] and was renamed ***quietly*** by Chrome before the change became officially accepted.

(This question was asked during this transition when there were no official documentation on this header and Chrome was the only browser that sent this header.)


  [1]: http://www.w3.org/TR/upgrade-insecure-requests/
  [2]: https://googlechrome.github.io/samples/csp-upgrade-insecure-requests/
  [3]: https://www.w3.org/TR/2015/CR-upgrade-insecure-requests-20151008/#preference
  [4]: https://stackoverflow.com/a/32003517/2891365
  [5]: https://www.w3.org/TR/2015/WD-upgrade-insecure-requests-20150424/#preference

All Upgrade Insecure-Requests Solutions on Gang of Coders

Total of 1 Upgrade Insecure-Requests Solutions

What is the "Upgrade-Insecure-Requests" HTTP header?