diff --git a/login.php b/login.php
index 44a656fe..3575c244 100644
--- a/login.php
+++ b/login.php
@@ -1,5 +1,6 @@
 <?php
 
+// Enforce a Content Security Policy for security against cross-site scripting
 header("Content-Security-Policy: default-src 'self' fonts.googleapis.com fonts.gstatic.com");
 
 if (!file_exists('config.php')) {
@@ -8,6 +9,14 @@ if (!file_exists('config.php')) {
 }
 
 require_once("config.php");
+
+// Check if the application is configured for HTTPS-only access
+if ($config_https_only && (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on')) {
+    echo "Login is restricted as ITFlow defaults to HTTPS-only for enhanced security. To login using HTTP, modify the config.php file by setting config_https_only to false. However, this is strongly discouraged, especially when accessing from potentially unsafe networks like the internet.";
+    exit;
+}
+
+
 require_once("functions.php");
 require_once("rfc6238.php");