---
schema_version: "1"
id: 58169fe40dc8da2def8aa0d7169513b00302d62d7c82c1a954b0648ea917bde2
title: Configure the Enforce HTTPS Global Preference
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_configure_enforce_https_global_preference.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_configure_enforce_https_global_preference.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ba86e2922fc860d10614610aafe4f830c5df53d2038d80a6a3697025ccd6cb43
description: Enforce the use of HTTPS for all sites in a B2C Commerce instance. When this setting is enabled, URLs generate using the HTTPS protocol, and incoming page requests that use HTTP redirect to HTTPS. HTTP requests to Open Commerce API (OCAPI)'s session bridge aren't accepted. Also, instead of a combination of session cookies and secure tokens, secure session cookies are used, which helps avoid incorrect (false positive) session hijacking detections. Enable the Enforce HTTPS global preference to let browsers send cookies in cross-site contexts.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Configure the Enforce HTTPS Global Preference

Enforce the use of HTTPS for all sites in a B2C Commerce instance. When this setting is enabled, URLs generate using the HTTPS protocol, and incoming page requests that use HTTP redirect to HTTPS. HTTP requests to Open Commerce API (OCAPI)'s session bridge aren't accepted. Also, instead of a combination of session cookies and secure tokens, secure session cookies are used, which helps avoid incorrect (false positive) session hijacking detections. Enable the Enforce HTTPS global preference to let browsers send cookies in cross-site contexts.

1. Click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Global Preferences** | **Security**.
2. On the Access Restriction tab, select **Enforce HTTPS**.
3. Click **Apply**.

When you enable the Enforce HTTPS setting globally, you can't configure it at the site level. If you disable the Enforce HTTPS global preference, B2C Commerce uses the previous site-specific settings.