HTTPS-only TLDs are extensions whose entire namespace is on the browser HSTS preload list, so every site loads over HTTPS automatically and plain HTTP is refused. The core set comes from Google Registry — .app, .dev, .page and .new — meaning you must have a valid TLS certificate for any domain under them. There is no insecure fallback, which makes these extensions a built-in security signal.
What "HTTPS-only" means at the TLD level
Most extensions leave HTTPS up to the site owner. A handful go further: the registry adds the whole extension to the HSTS preload list — a list compiled by the Chromium project and shipped inside Chrome, Firefox, Safari and Edge. Once an extension is preloaded, browsers refuse to make an insecure HTTP connection to any domain under it, before the site even responds. The practical effect: every .app or .dev site must serve a valid TLS certificate or it will not load at all. This eliminates downgrade attacks and mixed-content issues for the entire namespace by design.
HTTPS-only TLDs reference list
Core HSTS-preloaded extensions, their operator and intended audience. The preload list evolves; verify if security policy is critical.
| Extension | Operator | Intended audience | Security policy |
|---|---|---|---|
| .app | Google Registry | Apps & software products | HSTS-preloaded — HTTPS mandatory |
| .dev | Google Registry | Developers & engineering tools | HSTS-preloaded — HTTPS mandatory |
| .page | Google Registry | Personal & project pages | HSTS-preloaded — HTTPS mandatory |
| .new | Google Registry | Action shortcuts (e.g. doc.new) | HSTS-preloaded — HTTPS mandatory |
| .gle / .google | Google Registry | Google brand / shortlinks | Secure-by-policy |
| .chrome | Google Registry | Chrome brand | Secure-by-policy |
The authoritative source is the Chromium HSTS preload list; registry policy can change. Operator data from the IANA root zone database.
What this means in practice
If you register a .app, .dev or .page domain, set up TLS before you point traffic at it — without a certificate, visitors see a connection error rather than your site. The good news is that a free certificate from a provider like Let's Encrypt fully satisfies the requirement, so the only real cost is a few minutes of setup. In return you get a namespace that can never be served insecurely, which is a genuine trust and security advantage for software, developer and app brands.