Effective 2020, Esri will be implementing HTTPS ONLY in ArcGIS Online! You are therefore advised to prepare and/or enforce HTTPS immediately.

This advisory does not apply if your ArcGIS Online organization is already utilizing HTTPS and you do not have any external systems making requests to HTTP-based services. 

Why should you prepare if your organization has not utilize HTTPS only for their web services until now? Preparing is a must since transitioning to HTTPS ONLY can be a significant task for customers who share services with only HTTP support and for customers who have built web maps and apps with references to HTTP services, both from within ArcGIS Online and external to it (such as an older ArcGIS Server instance that is configured to only communicate via HTTP). 

To help you prepare, Esri will release an updated version of the ArcGIS Online Security Advisory next week. The update will include a check for HTTP references in a customer’s ArcGIS Online deployment. 

Also, Python tool will be released in the next month that can be utilized against both ArcGIS Online and ArcGIS Enterprise for discovering HTTP references that should be corrected to HTTPS. 

To learn more, read Michael Young’s blog – “Prepare for Next Major ArcGIS Online Security Advancement Now”.