diff --git a/src/main/java/moe/yushi/authlibinjector/AuthlibInjector.java b/src/main/java/moe/yushi/authlibinjector/AuthlibInjector.java
index e2c09bd..4919f6f 100644
--- a/src/main/java/moe/yushi/authlibinjector/AuthlibInjector.java
+++ b/src/main/java/moe/yushi/authlibinjector/AuthlibInjector.java
@@ -99,6 +99,7 @@ public final class AuthlibInjector {
 		String apiRoot = System.getProperty(PROP_API_ROOT);
 		if (apiRoot == null) return empty();
 		Logging.CONFIG.info("API root: " + apiRoot);
+		warnIfHttp(apiRoot);
 
 		String metadataResponse;
 
@@ -138,6 +139,12 @@ public final class AuthlibInjector {
 		return of(configuration);
 	}
 
+	private static void warnIfHttp(String url) {
+		if (url.toLowerCase().startsWith("http://")) {
+			Logging.CONFIG.warning("You are using HTTP protocol, which is INSECURE! Please switch to HTTPS if possible.");
+		}
+	}
+
 	private static ClassTransformer createTransformer(YggdrasilConfiguration config) {
 		ClassTransformer transformer = new ClassTransformer();
 		transformer.debugSaveClass = "true".equals(System.getProperty(PROP_DUMP_CLASS));