Myth: HTTPS postbacks are always more reliable than HTTP

Myth: HTTPS postbacks are always more reliable than HTTP

The claim: force every S2S postback URL to https:// and conversions stop dropping. Reality: TLS adds failure modes that plain HTTP does not have, and many networks fire postbacks from old libraries.

Where it breaks down:
— Expired or mismatched certs on your tracker domain silently 0-out postbacks. HTTP has no cert to expire.
— Networks on legacy cURL may not support TLS 1.2+. Their postback just fails closed.
— A redirect from http to https on the postback endpoint drops the query string on some senders.

The correction — verify, don't assume:
1. Pull 24h of postback logs, filter by HTTP status, count non-200s by network.
2. Test the exact postback URL with curl -v and read the TLS handshake line.
3. Check your cert expiry date is more than 30 days out.
4. If a network fails on https, accept http for that source and log it.

Use https where the sender supports it, but treat it as a setting you confirm per network, not a universal upgrade.

Run this before every launch.