# Chatbot HTTPS Requirements: What Your Site Needs in 2026

> Chatbot HTTPS requirements explained: secure the page, the widget script, data handling and retention, plus a checklist for small business sites before launch.

[Back to blog](https://konvuno.com/blog)October 28, 2026

Chatbot HTTPS requirements explained: secure the page, the widget script, data handling and retention, plus a checklist for small business sites before launch.

![](https://media.babylovegrowth.ai/blog-images/organization-42511/1793063493471_Customer-asking-a-website-chatbot-about-shipping.jpeg)

A website chatbot needs your site to run on HTTPS, and the widget itself must load over HTTPS too. No law or chatbot vendor has a single rulebook called “chatbot HTTPS requirements”, but in practice the demands are firm: an encrypted page, an encrypted script and connection, a valid certificate, and a sensible plan for the data visitors type into the chat box. This guide walks through each requirement, what it means for a small business, and how to check it in an afternoon.

Konvuno

Add a Website Assistant with Care

Konvuno answers questions from your site content, captures leads, and hands off to a human when a question needs one.

[Explore Konvuno](https://konvuno.com)

## TL;DR

- Serve your whole site over HTTPS with a valid certificate. Browsers block insecure scripts on secure pages, so a chat widget loaded over plain HTTP will simply fail.
- HTTPS protects data in transit only. You still decide what the bot collects, who sees it and how long transcripts are kept.
- Limit what the chatbot can access and do. Prompt injection is an inherent risk, so design for it instead of hoping a filter catches it.
- Keep a human in the loop for pricing, eligibility, money and other high-risk questions.
- Test before launch and read real conversations after it.

## Table of Contents

- [What “HTTPS requirements” really means for a chatbot](https://konvuno.com/blog/chatbot-https-requirements#what-https-requirements-really-means-for-a-chatbot)
- [Step one: get the site itself on HTTPS](https://konvuno.com/blog/chatbot-https-requirements#step-one-get-the-site-itself-on-https)
- [Step two: check how the widget loads and connects](https://konvuno.com/blog/chatbot-https-requirements#step-two-check-how-the-widget-loads-and-connects)
- [HTTPS protects the pipe, not what goes in it](https://konvuno.com/blog/chatbot-https-requirements#https-protects-the-pipe-not-what-goes-in-it)
- [Security beyond encryption: the AI-specific risks](https://konvuno.com/blog/chatbot-https-requirements#security-beyond-encryption-the-ai-specific-risks)
- [Make sure the bot answers from the right content](https://konvuno.com/blog/chatbot-https-requirements#make-sure-the-bot-answers-from-the-right-content)
- [Capabilities worth requiring](https://konvuno.com/blog/chatbot-https-requirements#capabilities-worth-requiring)
- [Perspective: why we think about security from the owner’s side](https://konvuno.com/blog/chatbot-https-requirements#perspective-why-we-think-about-security-from-the-owners-side)
- [Test before visitors do](https://konvuno.com/blog/chatbot-https-requirements#test-before-visitors-do)
- [Monitor and improve after launch](https://konvuno.com/blog/chatbot-https-requirements#monitor-and-improve-after-launch)
- [What does it cost to run a chatbot?](https://konvuno.com/blog/chatbot-https-requirements#what-does-it-cost-to-run-a-chatbot)
- [Putting it on your site](https://konvuno.com/blog/chatbot-https-requirements#putting-it-on-your-site)
- [FAQ](https://konvuno.com/blog/chatbot-https-requirements#faq)
- [Sources](https://konvuno.com/blog/chatbot-https-requirements#sources)

## What “HTTPS requirements” really means for a chatbot

People searching this phrase usually mean one of three things:

1. **Does my site need HTTPS to run a chatbot?** Practically, yes. Chat widgets are third-party scripts that send visitor messages to a server. Modern browsers treat a secure page that loads an insecure resource as “mixed content” and block active content such as scripts. If your site is still on HTTP, the widget may not load at all, and even if it does, messages travel in the clear.
2. **Does the chatbot vendor use HTTPS?** The script tag you paste, the API calls it makes and the dashboard you log in to should all run on encrypted connections. Ask the vendor to confirm it in writing, and open your browser’s developer tools to check that every request from the widget starts with `https://`.
3. **Is HTTPS enough to be “secure” or compliant?** No. Encryption in transit is the floor. Privacy law, security practice and plain customer trust ask for more.

The rest of this article follows those three questions in order.

## Step one: get the site itself on HTTPS

Before you install anything, confirm the basics on your own domain:

- **A valid certificate** issued for your exact domain, including the `www` version if you use it. Most hosts issue and renew certificates automatically.
- **Redirects from HTTP to HTTPS** so no visitor lands on an insecure version of a page that carries the chat widget.
- **No mixed content.** Old images, fonts or embedded scripts hard-coded with `http://` addresses cause browser warnings and can break widgets. A site-wide search in your theme and page content for `http://` finds most of them.
- **Certificate expiry monitoring.** An expired certificate shows visitors a full-page warning, and your chatbot goes down with the rest of the site.

If you run WooCommerce, this matters double. Checkout and account pages handle personal data, and a chat widget sitting on them should never be the weakest link.

## Step two: check how the widget loads and connects

A modern widget is usually one script tag. That convenience is worth a short audit, because you are letting a third party run code on your pages.

| Check | What good looks like | How to test it |
| --- | --- | --- |
| Script source | Loaded from an `https://` address | View page source, find the script tag |
| API calls | Every request in the Network tab uses HTTPS | Browser developer tools, Network tab |
| Console errors | No mixed-content warnings | Browser developer tools, Console tab |
| Dashboard login | HTTPS, with a strong password and ideally two-factor sign-in | Sign in and inspect the address bar |
| Feed or catalog sync | Product feed URLs use HTTPS | Check the feed address in your settings |

That last row is easy to miss. If your assistant answers questions from a WooCommerce catalog or a Google Merchant or Facebook product feed, the feed address should be an encrypted one too. Our guide on [how to connect your data to a website chatbot](https://konvuno.com/blog/connect-data-to-chatbot) covers the setup in detail.

## HTTPS protects the pipe, not what goes in it

Encryption stops someone on a coffee-shop network from reading a conversation as it travels. It does nothing about what your chatbot asks for, what it stores, or what it says back. Those are design decisions, and they are where most real risk sits.

### Collect less personal information

Ask only for what the next step needs. A bot that answers shipping questions has no reason to ask for a date of birth. For lead capture, a name and an email address is usually enough to start a conversation. Tell visitors plainly, in the chat itself, why you are asking and where to read your privacy policy.

### Tell visitors they are talking to a bot

Say it in the greeting. Some places are making this a legal duty: California, for example, has a law on bots that communicate with people to sell goods or influence votes. Whether it covers you depends on your use, so treat it as a prompt to check with a lawyer familiar with your market rather than a definitive rule. Disclosure is good practice either way, and it sets honest expectations.

### Decide how long transcripts live

Chat transcripts can contain names, order numbers, health details or addresses that visitors volunteer without being asked. Pick a retention period, write it down, and delete on schedule. Keep the shortest period that still lets you improve the bot and follow up with leads.

### Know where the data goes

The New Zealand government’s guidance on AI for small business recommends checking how vendors handle data and what security they offer, alongside limiting what you collect and monitoring outputs ([NCSC small business AI guidance](https://www.ncsc.govt.nz/assets/guidance/Documents/Artificial-Intelligence-for-Small-Business_D7.pdf)). Turn that into questions for any vendor: Where are conversations stored? Who can read them? Are they used to train models? Can I export and delete them?

If you serve visitors in the EU or UK, GDPR-style rules on consent, access and deletion may apply regardless of where your business is based. Because laws differ by country and change, confirm the details with a qualified privacy adviser before you launch in a new market.

## Security beyond encryption: the AI-specific risks

A chatbot that reads your content and answers in natural language has risks a contact form does not.

### Prompt injection

A visitor, or text hidden in a page or document the bot reads, can try to override its instructions. OWASP’s 2026 guidance on large language model applications treats this as an inherent risk and recommends architectural defenses: constrain what the chatbot can access and what actions it can perform, and assume the instruction boundary will eventually be bypassed ([OWASP Top 10 for LLM Applications 2026](https://genai.owasp.org/download/56857/)). The same document stresses that defense must be built into the design rather than relying on filters, because there is no reliable way today to tell data from instructions.

For a small business, that translates to simple rules:

- Give the bot read access to public content only: FAQs, pages, product feeds.
- Do not connect it to customer accounts, internal documents or payment tools unless you truly need to.
- Never put secrets, passwords or private pricing rules into the content it learns from.
- Let it answer and capture leads, but have a person perform any action with consequences.

Anthropic’s 2026 submission on agentic security makes a complementary point: security is a property of the whole system, and controls at different layers are not interchangeable, so resilient setups use layered defenses ([Anthropic’s NIST submission](https://www-cdn.anthropic.com/43ec7e770925deabc3f0bc1dbf0133769fd03812.pdf)). HTTPS is one layer. Limited access is another. Monitoring is a third.

### Sensitive data in, sensitive data out

New Zealand’s business.govt.nz guidance recommends training staff on what sensitive or proprietary information should never be entered into AI tools ([Safe and smart AI use](https://www.business.govt.nz/operations/getting-started-with-ai/safe-and-smart-ai-use)). The same rule applies to what you feed your bot. Upload only documents you are comfortable seeing quoted back. If you add PDFs, read [what works and what breaks when you upload a PDF to a chatbot](https://konvuno.com/blog/upload-pdf-to-chatbot) first.

### Spam and abuse

Public chat boxes attract bots and trolls. Rate limits, a cap on message length and a clear route to a person keep the experience usable. Review flagged conversations weekly at first.

### Keep a human in the loop

The same business.govt.nz guidance says high-risk scenarios, especially decisions about customers, staff, pricing, eligibility or finances, should keep a human in review or quality assurance. In practice, set rules for when the bot hands off: refund disputes, legal or medical questions, complaints, and any visitor who asks for a person.

![Chatbot escalation triggers and human review path](https://media.babylovegrowth.ai/blog-images/organization-42511/1793063602267_Chatbot-escalation-triggers-and-human-review-path.jpeg)

## Make sure the bot answers from the right content

Security and accuracy are linked. A bot that invents a return policy creates a legal and trust problem even on a perfectly encrypted page.

- **Pick your sources deliberately.** Decide which pages, FAQs and feeds the bot may use, and which win when they disagree. See [how to prioritize chatbot sources for accurate answers](https://konvuno.com/blog/prioritize-chatbot-sources) and [how to control chatbot sources on your website](https://konvuno.com/blog/control-chatbot-sources).
- **Keep product data fresh.** Prices and stock change daily. A feed that syncs automatically beats a manually uploaded spreadsheet.
- **Handle variants properly.** Size, color and price combinations are where bots most often get things wrong. Our piece on [chatbot product variants](https://konvuno.com/blog/chatbot-product-variants) explains how to get them right.
- **Be honest about fit advice.** For apparel, [size guide answers need fresh feeds](https://konvuno.com/blog/size-guide-chatbot-answers) and a willingness to say “I’m not sure”.

## Capabilities worth requiring

Once the technical foundation is sound, judge a chatbot on what it does for visitors:

- **Answers from your own material**, not generic internet knowledge.
- **Multilingual replies**, if your visitors do not all read English.
- **Lead capture** that stores contacts somewhere you can act on them.
- **Human handoff** that is easy to trigger and tells the visitor what happens next.
- **Analytics** showing what people actually ask, so you can fix gaps in your content.
- **Preview before you publish**, so you can try it as a visitor would.

## Perspective: why we think about security from the owner’s side

Most small business owners do not have a developer, a security team or a support desk. That shapes how we build and how we advise. We designed Konvuno so the owner configures everything from a hosted dashboard, with one script tag on the site and no developer dependency. That simplicity only helps if the owner understands what they are switching on.

Our view is that HTTPS is the entry ticket, not the finish line. The questions that decide whether a chatbot is safe for your business are the dull ones: what does it know, what can it do, who reviews it, and how long do we keep what visitors tell it? Keep its knowledge to public content you control, keep a person in charge of anything with money or eligibility attached, and read real conversations regularly. The analytics showing what visitors ask are not just a marketing tool. They are your early warning system.

> _— Konstantin_

## Test before visitors do

Run this checklist before the widget goes live on every page:

1. Load your site in a private browser window and confirm the padlock appears on every page that carries the widget.
2. Open developer tools and look for mixed-content warnings in the console.
3. Ask the bot the ten questions your customers ask most. Compare each answer to your actual policies.
4. Try to break it. Ask it to ignore its instructions, reveal its setup, or promise a discount. Note what happens.
5. Type fake personal details and check where they appear in your dashboard and who can see them.
6. Trigger a human handoff and confirm someone actually receives it.

We lay out a fuller routine in [how to test chatbot replies before your visitors do](https://konvuno.com/blog/test-chatbot-replies).

## Monitor and improve after launch

Launch is the start. For the first month, read conversations every few days. Look for questions the bot could not answer, answers that were wrong, visitors asking for a human, and anything personal that people volunteered. Fix the source content rather than patching individual replies, then re-test. After that, a weekly or monthly review is usually enough, with extra attention after you change prices, policies or your catalog.

## What does it cost to run a chatbot?

Cost depends on a few factors: the number of conversations, how many languages and sources you support, whether you need a built-in CRM and human handoff, and whether the vendor charges per seat. Also count your own time for setup and review, plus any security or legal advice for regulated markets.

Konvuno publishes three subscription plans: Starter at €29 per month, Growth at €79 per month and Business at €199 per month. There are no per-seat fees, and you can configure and preview the assistant before paying. That makes it easier to judge the real work involved before you commit.

![What does it cost to run a chatbot? — overview diagram](https://media.babylovegrowth.ai/blog-images/organization-42511/1793063562274_What-does-it-cost-to-run-a-chatbot-overview-diagram.jpeg)

## Putting it on your site

If your site is already on HTTPS and you want an assistant that answers from your own FAQs, pages and product feeds, captures leads and hands off to a person when needed, we built Konvuno for exactly that. It works in seven languages, syncs catalogs from WooCommerce or any Google Merchant or Facebook product feed, and installs with a single script tag. See the plans on [Konvuno’s pricing page](https://konvuno.com/).

![Konvuno](https://csuxjmfbwmkxiegfpljm.supabase.co/storage/v1/object/public/blog-images/organization-42511/1786796293645_konvuno.jpg)

Set it up, preview it, run the checklist above, and go live when you are satisfied with what it says.

## FAQ

### Do I need HTTPS to add a chatbot to my website?

In practice, yes. Browsers block insecure scripts on secure pages, and an HTTP site sends visitor messages unencrypted. Move your site to HTTPS first, then install the widget.

### Is HTTPS enough to make a chatbot secure?

No. HTTPS protects data while it travels between the visitor and the server. You also need to limit what the bot collects and can access, check how the vendor stores data, and review conversations. Prompt injection, for example, is not stopped by encryption.

### How long should I keep chat transcripts?

Keep them only as long as you need them to improve the bot and follow up with leads, then delete them. There is no single period that suits every business, and privacy laws in your market may set limits, so check with a privacy adviser and write the period in your privacy policy.

### Should a chatbot be able to take actions like refunds or price changes?

For most small businesses, no. Official guidance on safe AI use recommends human review for decisions affecting pricing, eligibility or finances. Let the bot answer and collect details, and have a person approve anything with consequences.

## Sources

- [Artificial Intelligence for Small Business, NCSC New Zealand](https://www.ncsc.govt.nz/assets/guidance/Documents/Artificial-Intelligence-for-Small-Business_D7.pdf)
- [Safe and smart AI use, Business.govt.nz](https://www.business.govt.nz/operations/getting-started-with-ai/safe-and-smart-ai-use)
- [OWASP Top 10 for LLM Applications 2026](https://genai.owasp.org/download/56857/)
- [Anthropic response to the NIST RFI on agentic security](https://www-cdn.anthropic.com/43ec7e770925deabc3f0bc1dbf0133769fd03812.pdf)

## Recommended

- [How to Control Chatbot Sources on Your Website](https://konvuno.com/blog/control-chatbot-sources)
- [How to Connect Your Data to a Website Chatbot](https://konvuno.com/blog/connect-data-to-chatbot)
- [How to Test Chatbot Replies Before Your Visitors Do](https://konvuno.com/blog/test-chatbot-replies)
- [How to Prioritize Chatbot Sources for Accurate Answers](https://konvuno.com/blog/prioritize-chatbot-sources)

---

Canonical: https://konvuno.com/blog/chatbot-https-requirements
Index: https://konvuno.com/llms.txt