diff --git a/app/ui.js b/app/ui.js
index e1c58923..95f938d6 100644
--- a/app/ui.js
+++ b/app/ui.js
@@ -61,6 +61,14 @@ const UI = {
         // Translate the DOM
         l10n.translateDOM();
 
+        // We rely on modern APIs which might not be available in an
+        // insecure context
+        if (!window.isSecureContext) {
+            // FIXME: This gets hidden when connecting
+            UI.showStatus(_("HTTPS is required for full functionality"), 'error');
+        }
+
+        // Try to fetch version number
         fetch('./package.json')
             .then((response) => {
                 if (!response.ok) {
diff --git a/core/rfb.js b/core/rfb.js
index 121d9e5e..578a8984 100644
--- a/core/rfb.js
+++ b/core/rfb.js
@@ -79,6 +79,12 @@ export default class RFB extends EventTargetMixin {
             throw new Error("Must specify URL, WebSocket or RTCDataChannel");
         }
 
+        // We rely on modern APIs which might not be available in an
+        // insecure context
+        if (!window.isSecureContext) {
+            Log.Error("noVNC requires a secure context (TLS). Expect crashes!");
+        }
+
         super();
 
         this._target = target;