diff --git a/oauth3.core.js b/oauth3.core.js
index 806b4b6..f71487d 100644
--- a/oauth3.core.js
+++ b/oauth3.core.js
@@ -2,6 +2,10 @@
 ;(function (exports) {
   'use strict';
 
+  if ('undefined' !== typeof window && 'https:' !== window.location.protocol) {
+    window.alert("You must use https. We suggest using caddy as your webserver (or serve-https if testing locally)");
+  }
+
   var OAUTH3 = exports.OAUTH3 = {
     clientUri: function (location) {
       return OAUTH3.uri.normalize(location.host + (location.pathname || ''));