I think @Jake is looking for a programmatic solution here rather than a configuration update. It is better if you block your request in the back end if it is not coming through TLS channel.
What you can do is, create a custom filter class which inherited from the ActionFilterAttribute class. Then you can override the OnActionExecuting method to cater your requirement. You can check the request against the Uri.UriSchemeHttps and perform an appropriate action.
Following is a sample code(Please note that I am giving this as an example. It may not suitable 100% for your production environment).
public class MyHttpsOnlyFilter : ActionFilterAttribute
public override void OnActionExecuting(HttpActionContext context)
var request = context.Request;
if (request.RequestUri.Scheme != Uri.UriSchemeHttps)
var response = request.CreateResponse(HttpStatusCode.Forbidden);
response.Content = new StringContent("This API accepts only HTTPS requests");
context.Response = response;