# Resolve confusion about admin interface over https vs http on local network

**URL:** <https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073>\
**Category:** Help\
**Created:** [October 25, 2026, 8:48pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073 "2026-10-25T20:48:20Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![dingman](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/d/e5b9ba/32.png) [@dingman](https://discourse.pi-hole.net/u/dingman)\
**Post date:** [October 25, 2026, 8:48pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/1 "2026-10-25T20:48:20Z")

</div>

If you follow the post-install directions on a clean pi-hole setup in a local network, you'll be directed to `pi.hole:80/net` or `{pihole_local_ip}:80/admin`. The admin login then looks like this, with a prominent hint you should "Consider upgrading to HTTPS":

 ![image](https://discourse-cdn.pi-hole.net/uploads/default/original/3X/d/f/dfa9725830072a8e2d14329a6958a04de905c3f2.png)

Following the link leads to a [lengthy excursus on HTTPS for folks who run piholes on VPS](https://discourse.pi-hole.net/t/enabling-https-for-your-pi-hole-web-interface/5771) — actually a thread from a year years back with many comments by people with very different setups (itself an indication that this is a pretty confusing topic).

Anyone doing some reading around finds that [even in pihole V6 (2025) setting up HTTPS is not straightforward](https://discourse.pi-hole.net/t/what-about-enabling-https-in-pi-hole-v6/77666/2). And if you dig a little deeper you also find [much older threads](https://discourse.pi-hole.net/t/admin-web-interface-over-https/562) where proposals to support HTTPS out of the box are judged "out of scope" and folks argue that if you're running a pi on your own local network (= many of us), HTTPS would be overkill anyway.

E.g. @Anudeep [saying](https://discourse.pi-hole.net/t/admin-web-interface-over-https/562/9)

> As @deathbybandaid said, if you don't have external access web interface, there is no need to use https unless you're MITMed in your own home network

# Expected behavior

Only show the "Consider upgrading to HTTPS" if (i) it actually makes sense and (ii) there's a clear and unambiguous way of doing so.

In the case of a local install where the admin is not exposed to the outside web, and where self-certifying is not straightforward (apparently still the case in 2026), then don't suggest it.

# Reasonable solution

Modify the text to be more clear about the conditions in which HTTPS is key: "If you're running pi-hole on a VPS or exposed to the outside web, make sure to enable HTTPS".

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [October 25, 2026, 9:48pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/2 "2026-10-25T21:48:00Z")

</div>

**NOTE:**

> [@dingman](#):
>
> you'll be directed to `pi.hole:80/net`

This is not correct (maybe it was just a typo).  
There is no `/net` in Pi-hole web interface. The correct path is `/admin`

---

<div class="post-metadata">

**Author:** ![dingman](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/d/e5b9ba/32.png) [@dingman](https://discourse.pi-hole.net/u/dingman)\
**Post date:** [October 26, 2026, 7:18am UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/3 "2026-10-26T07:18:06Z")

</div>

Yes typo of course

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [October 26, 2026, 4:51pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/4 "2026-10-26T16:51:41Z")

</div>

> [@dingman](#):
>
> Anyone doing some reading around finds that [even in pihole V6 (2025) setting up HTTPS is not straightforward](https://discourse.pi-hole.net/t/what-about-enabling-https-in-pi-hole-v6/77666/2).

It's super simple :

- Go to _System -\> Settings_ and click on _Basic_ in the top right corner to enable the _Expert Settings View_
- Go to _System -\> All Settings -\> Web Server and API -\> webserver.port_
- Enter there something like _192.168.1.2:443s_ instead of the default _"80o,443os,[::]:80o,[::]:443os"_ value.

And you are _DONE!_ 🙂

I have done all of this via the lovely _pihole.toml_ file right after Pi-Hole v6 was released and never looked back! 😎😬👍👍

If you get the error complaining about the Self Signed Certificate not matching the Host's Domain name or something like that then just delete the certificate via SSH (`/etc/pihole/tls.pem`) and restart Pi-Hole and you have fixed it forever! 😉

Having HTTPS access to the webGUI of Pi-Hole this easily is one of my favorite things about Pi-Hole v6 😍

---

<div class="post-metadata">

**Author:** ![dingman](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/d/e5b9ba/32.png) [@dingman](https://discourse.pi-hole.net/u/dingman)\
**Post date:** [October 26, 2026, 10:35pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/5 "2026-10-26T22:35:08Z")

</div>

> [@nero355](#):
>
> - Enter there something like _192.168.1.2:443s_ instead of the default _"80o,443os,[::]:80o,[::]:443os"_ value.

Ah well. I just tried that and either I made an error or it is not as straightforward as hoped, because it had the effect of locking me out of the web interface. 😅

Fortunately your directions also pointed me to the place to get back into it. For onlookers, here's what I did:

Pretending my local IP is 192.168.1.2, the entry reads `192.168.1.2:80or,443os`

This can be entered either in the web interface GUI as directed above, or by editing the [webserver] entry in the file `/etc/pihole/pihole.toml`

If you make an error like me and the web interface is no longer accessible, SSH-ing into the pihole and editing the toml file is the only option.

Reading the instructions in the toml file, I think what this means is that port 80 is optional but will fallback to SSL (443). You could also use an `r` suffix to force a redirect.

If I get into the web interface now and change from HTTP to HTTPS, Firefox first forces me to add an exception. When added, it does allow me to browse the web interface over HTTPS, but Firefox displays a giant Not Secure button in the address bar.

So then, returning to OP: How can we reduce confusion about this issue? As long as browsers complain and switching this on requires one to add an exception I don't think it's a great user experience... and if the instructions are so hard to find & likely to vary in outcomes, why suggest the switch to HTTPS on every single web interface opening screen?

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [October 27, 2026, 12:00am UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/6 "2026-10-27T00:00:42Z")

</div>

> [@dingman](#):
>
> If I get into the web interface now and change from HTTP to HTTPS, Firefox first forces me to add an exception. When added, it does allow me to browse the web interface over HTTPS, but Firefox displays a giant Not Secure button in the address bar.

This is 100% expected.

Firefox (and all other browsers) show a warning when the certificate cannot be verified. When you add an exception, Firefox allows you to access, but it still shows the certificate can't be verified.

If you want to access using HTTPS **and also wants to fix the "Not Secure" icon on the browser** you will need to [add the certificate authority](https://docs.pi-hole.net/api/tls/#adding-the-ca-to-your-browser) to the browser.

This is the only way to make your browser know your locally created certificate.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [October 27, 2026, 12:19am UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/7 "2026-10-27T00:19:00Z")

</div>

If you don't like the line that suggests you consider upgrading to HTTPS, and feel it doesn't apply to you then just ignore it.

That warning has educated numbers of users in to learning more about their systems and how the web works.

It appears that your research neglected the one place that would have been beneficial, our documentation: [TLS/SSL - Pi-hole documentation](https://docs.pi-hole.net/api/tls/)

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [October 27, 2026, 2:05pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/8 "2026-10-27T14:05:36Z")

</div>

> [@dingman](#):
>
> If I get into the web interface now and change from HTTP to HTTPS, Firefox first forces me to add an exception. When added, it does allow me to browse the web interface over HTTPS, but Firefox displays a giant Not Secure button in the address bar.
> 
> So then, returning to OP: How can we reduce confusion about this issue? As long as browsers complain and switching this on requires one to add an exception I don't think it's a great user experience... and if the instructions are so hard to find & likely to vary in outcomes, why suggest the switch to HTTPS on every single web interface opening screen?

Where does your Firefox force you to add the exception ?!

AFAIK that option has disappeared years ago and is the reason that I always use Pale Moon instead, because it has the good old GUI where accepting Self Signed Certificates is just a couple of clicks and it never bothers you again about it 😎😬👍👍

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [October 27, 2026, 5:51pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/9 "2026-10-27T17:51:33Z")

</div>

I need to point 2 errors related to the information above:

1. 

> [@dingman](#):
>
> Firefox first forces me to add an exception

Firefox doesn't force anything.  
It's a choice: the user needs to choose between adding an exception or going back to avoid the unknown certificate.

2. 

> [@nero355](#):
>
> AFAIK that option has disappeared years ago

The option is [still there](https://support.mozilla.org/en-US/kb/error-codes-secure-websites#w_understand-the-error-code), like described by _dingman_.  
If you click on the "_Procced to ..._" button, an exception will be added to the domain.

Firefox doesn't allow exceptions for [specific major public websites and in special cases](https://support.mozilla.org/en-US/kb/error-codes-secure-websites#w_when-you-cant-bypass-the-warning), but they are generally allowed for local websites.

* * *

Anyway, the general rule should be: never add an exception for public websites.  
The certificate check is there for your protection.

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [October 27, 2026, 8:01pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/10 "2026-10-27T20:01:41Z")

</div>

> [@rdwebdesign](#):
>
> 1. The option is [still there](https://support.mozilla.org/en-US/kb/error-codes-secure-websites#w_understand-the-error-code), like described by _dingman_.  
> If you click on the "_Procced to ..._" button, an exception will be added to the domain.

I see the issue now : It's not permanent!

Once I close the browser my cache is deleted and the exception too 😬

Pale Moon does not do that luckily! ❤

---

<div class="post-metadata">

**Author:** ![dingman](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/d/e5b9ba/32.png) [@dingman](https://discourse.pi-hole.net/u/dingman)\
**Post date:** [October 27, 2026, 8:41pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/11 "2026-10-27T20:41:41Z")

</div>

> If you don't like the line that suggests you consider upgrading to HTTPS, and feel it doesn't apply to you then just ignore it.

No it's not that I don't like it or that I'd want to ignore it. I am saying (and demonstrating I guess 😅 ) that it is actively confusing users who think it _might_ apply and who _might_ consider upgrading to HTTPS.

> [@DanSchaper](#):
>
> It appears that your research neglected the one place that would have been beneficial, our documentation: [TLS/SSL - Pi-hole documentation](https://docs.pi-hole.net/api/tls/)

Aha! Well that also provides a very simple solution: in the admin interface login screen, I'd propose changing the target of the HTTPS link (which right now goes to `https://{your-ip}/admin`) to that very piece of documentation.

Reasons:

1. Out of the box, the HTTPS variant _won't_ work on most browsers and for most pihole installations. It seems the default settings after a fresh install all assume http, not https, and there's quite a few moving parts to get right until HTTPS works. To send the user to a non-working HTTPS URL is confusing.
2. _If_ users are indeed interested in changing to HTTPS, this will point them to the authoritative guide on how to do this, rather than leaving them to do their own google searches and turn up many apparently irrelevant or superseded threads.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [October 27, 2026, 8:58pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/12 "2026-10-27T20:58:20Z")

</div>

> [@dingman](#):
>
> Aha! Well that also provides a very simple solution: in the admin interface login screen, I'd propose changing the target of the HTTPS link (which right now goes to `https://{your-ip}/admin`) to that very piece of documentation.

I completely agree, and I thought that was how it was configured. We had some discussion internally about the URL and how to improve the process.

> [@nero355](#):
>
> Pale Moon does not do that luckily!

Neither does Firefox, or Edge, or Chrome....

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [October 28, 2026, 9:19pm UTC](https://discourse.pi-hole.net/t/resolve-confusion-about-admin-interface-over-https-vs-http-on-local-network/88073/13 "2026-10-28T21:19:13Z")

</div>

> [@DanSchaper](#):
>
> Neither does Firefox, or Edge, or Chrome....

Like I said :  
Firefox/LibreWolf does in case you have configured it to delete your Cache after it has been closed.

I don't use the other ones so no idea how they deal with it 🙂