diff --git a/README.md b/README.md
index 13515f1..9d13a79 100644
--- a/README.md
+++ b/README.md
@@ -44,6 +44,7 @@ _Feel free to suggest any other ways to make the process safer._
     - MAX_EXPIRE - maximum lifetime period, default 24h
     - PIN_SIZE - size (in characters) of the pin, default 5
     - PIN_ATTEMPTS - maximum number of failed attempts to enter pin, default 3
+    - PROTOCOL - http or https
 1. Setup SSL:
     - The system can make valid certificates for you automatically with integrated [nginx-le](https://github.com/umputun/nginx-le). Just set:
         - LETSENCRYPT=true
diff --git a/app/main.go b/app/main.go
index f1e3499..b41d824 100644
--- a/app/main.go
+++ b/app/main.go
@@ -24,6 +24,7 @@ var opts struct {
 	WebRoot        string        `long:"web" env:"WEB" default:"./ui/static/" description:"web ui location"`
 	Dbg            bool          `long:"dbg" description:"debug mode"`
 	Domain         string        `short:"d" long:"domain" env:"DOMAIN" description:"site domain" required:"true"`
+	Protocol       string        `short:"p" long:"protocol" env:"PROTOCOL" description:"site protocol" choice:"http" choice:"https" default:"https" required:"true"` // nolint
 }
 
 var revision string
@@ -42,6 +43,7 @@ func main() {
 
 	srv, err := server.New(messager.New(dataStore, crypter, params), revision, server.Config{
 		Domain:         opts.Domain,
+		Protocol:       opts.Protocol,
 		PinSize:        opts.PinSize,
 		MaxPinAttempts: opts.MaxPinAttempts,
 		MaxExpire:      opts.MaxExpire,
diff --git a/app/server/server.go b/app/server/server.go
index 5c622a1..706dc1b 100644
--- a/app/server/server.go
+++ b/app/server/server.go
@@ -26,6 +26,7 @@ import (
 type Config struct {
 	Domain  string
 	WebRoot string
+	Protocol       string
 	// Validation parameters
 	PinSize        int
 	MaxPinAttempts int
diff --git a/app/server/web.go b/app/server/web.go
index 14bb97b..c7b561f 100644
--- a/app/server/web.go
+++ b/app/server/web.go
@@ -159,7 +159,7 @@ func (s Server) generateLinkCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	msgURL := fmt.Sprintf("http://%s/message/%s", s.cfg.Domain, msg.Key)
+	msgURL := fmt.Sprintf("%s://%s/message/%s", s.cfg.Protocol, s.cfg.Domain, msg.Key)
 
 	s.render(w, http.StatusOK, "secure-link.tmpl.html", "secure-link", msgURL)
 }
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index b803506..bcac925 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -21,5 +21,6 @@ services:
            - PIN_ATTEMPTS=3
            - MAX_EXPIRE=24h
            - DOMAIN=localhost:8080
+           - PROTOCOL=http
         ports:
           - "8080:8080"