The ArcGIS platform uses HTTPS (Hypertext Transfer Protocol for secure communication) as a key component of its security for web and service API connections. This includes connections between Esri software, such as ArcGIS Desktop and ArcGIS Enterprise, with ArcGIS Online. Starting December 2020, Esri will update ArcGIS Online to enforce the use of HTTPS Only for all organizations, without exception, to improve ArcGIS Online web security communication and to meet security requirements mandated by customers, such as site-wide enforcement of HTTP Strict Transport Security (HSTS).
What do you need to do?
Visit Trust ArcGIS site to access the “ArcGIS Online Security Advisor” tool (top right corner of the web page), which includes a check for HTTP references in an ArcGIS Online subscription. Please run this tool against your ArcGIS Online Organization.
The Security Advisor will detect several HTTP references. Typically, web maps will be impacted by this change, but other items will also be impacted. Web maps that include HTTP references should be switched to HTTPS. A good practice is to ensure your Organization is set to HTTPS, and when building web maps (and other items), ensure they reference HTTPS services.
Please make sure to check the following and switch them to HTTPS:
- References to on-premises ArcGIS Enterprise (ArcGIS Server) services owned by you
- References to third-party ArcGIS Enterprise (ArcGIS Server) services
- References to public ArcGIS Online-hosted feature services
- Third-party OGC services such as WMS, WFS and WMTS
- Your feature services might store URLs as an attribute. These URLs should be switched to HTTPS
- ArcGIS Online Item Descriptions might include an HTTP reference embedded in the description
- References to public images
Please note the ArcGIS Online setting of allowing access to the organization through HTTPS Only is not linked to ArcGIS Hub at this time. Check here for details on how to set a Hub site to HTTPS. You can also check all the latest information and important updates for the ArcGIS platform and HTTPS Only enforcement here.