# CMP-HTTPS — Every URL must use HTTPS

> All URLs in the registration must use https://; plain http:// is rejected.

- **Rule ID:** CMP-HTTPS
- **Layer:** Campaign (`CAMPAIGN`)
- **Checks:** `campaign.sample[] + campaign.message_flow + urls`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** Twilio, Infobip, TCR, Bandwidth
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/campaign/cmp-https/

## Why this rule exists

A plain http:// link exposes the recipient to interception on exactly the channel carriers are trying to make trustworthy, so it is refused. This is the single highest-consequence cheap defect in the catalog: Twilio's current code for it is NOT eligible for resubmission, so one forgotten "s" can permanently kill a campaign rather than earning a fixable rejection.

## How to fix it

Replace every http:// link with its https:// equivalent and confirm the certificate is valid.

## Example of a compliant value

```text
https://acmecoffee.com/sale
```

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Twilio (gen2) | `30964` | no |
| Infobip | `10900` | yes |

## Notes

Twilio 30964 is NOT eligible for resubmission — a plain http:// link can permanently kill a campaign. Highest severity-to-effort ratio in the whole catalog.