Is there any method to know whether a website is https only or uses http webpages as well?Can it be done without using browsers cache?
I'm going to assume that you are talking about HSTS.
HSTS is TOFU (Trust on first use). So from the second use onwards, you are protected.
But what about that first use?
I don't think there's a unified strategy. But here's some ideas:
What works today
- HSTS Preloading: Use a browser that makes use of the HSTS preload lists. (Chrome, Firefox) And hope that the developers of the website you want to visit have had their website listed for HSTS preloading..
- HTTPS Everywhere: There the EFF's HTTPS Everywhere project that uses a browser side plugin (Chrome, Firefox) and a large list of redirect rules, to redirect plain HTTP requests to encrypted HTTPS sites. This plugin only works if a rule has in fact been created for the website you want to visit. But -- other than HSTS pre-loading -- this does not depend on the webmaster's cooperation. Rules can be submitted by anyone.
What might work in the future
DANE/DNSSEC: DNS is a general purpose vehicle for storing info about domain names. Wikipedia's article about HSTS hints that this might be used in the future to indicate HTTPS support. -- "DANE" is a mechanism that uses DNSSEC (the signed form of DNS) to communicate crypto info about a domain name. For example to say "only this CA may sign my HTTPS certificates". This is achieved by placing something like this record in your DNS server:
_443._tcp.www.example.com. IN TLSA (
0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
Now this tells anyone (who cares to ask) that a specific crypto key is associated in some way with a service that's running on port 443 on www.example.com.
Now a human can easily guess: "Okay, 443 will probably be HTTPS", and then connect with HTTPS instead of plain HTTP. But what you can't deduce from an existing DANE record is that HTTPS is fully supported for every bit of the web site. (For example HTTPS might only be used for login to that site and not work for the rest of the site.)
But AFAIK there is no mechanism yet to communicate "Use HTTPS!" to a browser.