Facebook HTTPS: Is Your Connection Secure, and What Still Needs Doing?

Years ago, one of the most common pieces of Facebook security advice was "turn on secure browsing," a setting that made Facebook load over HTTPS instead of plain HTTP. If you've landed here looking for that switch, the short answer is: you don't need it anymore. Facebook encrypts every connection by default. But HTTPS only solves one problem, and there are other steps that matter far more for keeping a Facebook account safe today.

What HTTPS is, in one paragraph

HTTPS is the encrypted version of the protocol your browser uses to talk to websites. With HTTPS, the information traveling between your device and the site, such as your password, messages and the pages you view, is scrambled so that someone on the same network (say, a coffee shop Wi-Fi) can't read it or tamper with it. Browsers show this with a padlock or a similar icon next to the address, and the address starts with https://.

A short history of Facebook and HTTPS

• 2011: Facebook introduced HTTPS as an opt-in "secure browsing" setting, shortly after a widely publicized browser add-on showed how easy it was to hijack unencrypted Facebook sessions on public Wi-Fi.
• November 2012: Facebook began turning HTTPS on by default, starting with users in North America.
• July 2013: Facebook announced that it had moved all users to HTTPS by default. The Facebook mobile apps had already been using encrypted connections.

Since then there's been nothing to switch on. The old setting is gone, and if any guide tells you to find "Secure Browsing" in your security settings, it's out of date.

What HTTPS protects

• Your login and session from being intercepted on shared or public networks.
• The content of what you view and send while it travels between your device and Facebook.
• Integrity of the page, meaning someone on the network can't inject fake content into the Facebook page you're viewing.

What HTTPS does not protect

This is where most real-world problems happen:

• Phishing pages. A fake login page can have HTTPS and a padlock too. The padlock means the connection is encrypted, not that the site is honest.
• Weak or reused passwords. If your Facebook password was leaked from another site, HTTPS can't help.
• Malicious links and apps. A link that gets you to install something or hand over a code bypasses encryption entirely.
• What Facebook itself does with your data. HTTPS secures the pipe, not the privacy settings at either end.

The security steps that matter now

1. Check the address before you log in

Before typing your password, look at the address bar. The domain should be facebook.com, with nothing odd in front of the final .com (for example, facebook.com.security-check.example is not Facebook). Better still, open Facebook from a bookmark or the official app rather than a link in an email or message.

2. Turn on two-factor authentication

Two-factor authentication means that logging in from a new device also requires a code from an authentication app, a text message, or a physical security key. You'll find it in Meta's Accounts Center under Password and security. An authentication app or security key is stronger than text messages.

3. Consider a passkey

Facebook began rolling out passkeys on its iPhone and Android apps in 2025. A passkey lets you sign in with your phone's fingerprint, face or screen lock instead of typing a password, and it can't be phished in the same way a password can. If your app offers it, look in Accounts Center under Password and security.

4. Turn on login alerts

Login alerts tell you when someone signs in from a device or browser Facebook doesn't recognize. Our guide to Facebook login notifications shows where to switch them on and what to do if one arrives.

5. Review where you're logged in

In Accounts Center, under Password and security, the Where you're logged in list shows devices with access to your account. Log out of anything you don't recognize, then change your password.

6. Keep your devices updated

Browser and operating system updates fix security holes. Turn on automatic updates on phones, tablets and computers in your household.

Teaching kids the padlock lesson

HTTPS is a good teaching moment for kids and teens, because the lesson applies everywhere online:

• The padlock means "the connection is private," not "this site is safe."
• Always check the address, especially on login pages.
• Never type a password into a page you reached from a link in a message.
• Never share a code someone sends to your phone, even if they say they're from Facebook, Instagram or a friend.

Kids who learn this early are far harder to phish. Our broader guide to viruses, malware and hackers covers the other common tricks, and protecting your Facebook account from hackers goes deeper on account takeovers.

Signs your account may already be compromised

HTTPS can't tell you whether someone else already has your password. Watch for these warning signs:

• Friends mention messages or posts from you that you didn't send.
• You get a login alert or a password-change email you didn't trigger.
• Your name, email address or phone number has changed in Accounts Center.
• New apps appear under Apps and websites, or ads you didn't create run from your account.

If any of these happen, change your password right away from a device you trust, log out of unknown sessions in Where you're logged in, and turn on two-factor authentication. If you're already locked out, go to facebook.com/hacked and follow the recovery steps.

Security checklist

• Nothing to switch on for HTTPS; it has been the default since 2013.
• Open Facebook from a bookmark or the official app, and check the address before logging in.
• Two-factor authentication on, preferably with an authentication app or security key.
• Passkey set up if your app offers it.
• Login alerts on.
• Unknown devices removed from Where you're logged in.
• Automatic updates on for every family device.