Answer

Does a PWA need HTTPS?

Short answer

Yes, a PWA needs HTTPS. Browsers refuse to register a service worker on a plain HTTP origin because it can intercept and modify every network request, which would be a serious security risk over an unencrypted connection. The only exception is localhost and 127.0.0.1, which browsers treat as a secure context for local development.

By InstantPWA engineering·Reviewed July 25, 2026

Why the restriction exists

A service worker can rewrite any response on its origin, so allowing it over HTTP would let a network attacker inject malicious code indefinitely, even after the user leaves the compromised network.

Development exception

localhost, 127.0.0.1 and file:// origins are treated as secure contexts, so you can develop and test service workers without a certificate.

Getting HTTPS in production

Free certificates from Let’s Encrypt, or automatic HTTPS from hosts like Netlify, Vercel and Cloudflare Pages, cover essentially every deployment scenario today.

Sources

MDN — Secure contexts

What is a PWA?

A PWA (Progressive Web App) is a regular website that meets three technical criteria — HTTPS, a Web App Manifest and a service worker — so browsers let visitors install it on their home screen. Once installed, it launches like a native app, works offline and can send push notifications.

Why is my PWA install prompt not showing?

Chrome shows the install prompt only when the site passes strict installability criteria: HTTPS, a valid manifest with name, icons and start_url, a registered service worker with a fetch handler, and the user has not previously dismissed the prompt. Any one of these missing is enough to block the prompt entirely.

What is the service worker lifecycle?

A service worker moves through four stages: install (fired once when the browser first downloads a new or changed worker), waiting (if an old version still controls open tabs), activate (once it takes control, typically after all old tabs close or skipWaiting() is called) and idle, where the browser terminates it between events to save memory.

How do you update a PWA’s service worker?

Browsers automatically check your service-worker script for byte-level changes on every navigation (and roughly every 24 hours in the background). If it differs, the new version installs and waits until old tabs close before activating. Calling self.skipWaiting() in install and clients.claim() in activate makes the new version take over immediately instead of waiting.

What is the difference between cache-first and network-first caching?

Cache-first checks the cache first and only goes to the network if there is no cached match — best for static assets like fonts and logos that rarely change. Network-first always tries the network first and falls back to the cache only if the request fails — best for content that should be as fresh as possible, like an API response, while still working offline.