diff --git a/core/lib/Drupal/Component/Utility/Html.php b/core/lib/Drupal/Component/Utility/Html.php
index dc9fbb26757601916cfdb1903339a1d4faa0a13f..38b328a4c61c9ab6544a8ca70fb9055be73241e7 100644
--- a/core/lib/Drupal/Component/Utility/Html.php
+++ b/core/lib/Drupal/Component/Utility/Html.php
@@ -441,11 +441,11 @@ public static function escape(string $text): string {
    * change other relative URLs because they would result in different absolute
    * URLs depending on the current path. For example: when the same content
    * containing such a relative URL (for example 'image.png'), is served from
-   * its canonical URL (for example 'http://example.com/some-article') or from
-   * a listing or feed (for example 'http://example.com/all-articles') their
+   * its canonical URL (for example 'https://example.com/some-article') or from
+   * a listing or feed (for example 'https://example.com/all-articles') their
    * "current path" differs, resulting in different absolute URLs:
-   * 'http://example.com/some-article/image.png' versus
-   * 'http://example.com/all-articles/image.png'. Only one can be correct.
+   * 'https://example.com/some-article/image.png' versus
+   * 'https://example.com/all-articles/image.png'. Only one can be correct.
    * Therefore relative URLs that are not root-relative cannot be safely
    * transformed and should generally be avoided.
    *
diff --git a/core/lib/Drupal/Component/Utility/UrlHelper.php b/core/lib/Drupal/Component/Utility/UrlHelper.php
index 3b32dc9625e69330049cd9bf79b0ef74d8622cf6..9619dcf0703105754d04ad8d84a829822a44e6fd 100644
--- a/core/lib/Drupal/Component/Utility/UrlHelper.php
+++ b/core/lib/Drupal/Component/Utility/UrlHelper.php
@@ -216,7 +216,7 @@ public static function parse($url) {
     else {
       // parse_url() does not support relative URLs, so make it absolute. For
       // instance, the relative URL "foo/bar:1" isn't properly parsed.
-      $parts = parse_url('http://example.com/' . $url);
+      $parts = parse_url('https://example.com/' . $url);
       // Strip the leading slash that was just added.
       $options['path'] = substr($parts['path'], 1);
       if (isset($parts['query'])) {
@@ -248,13 +248,13 @@ public static function encodePath($path) {
   /**
    * Determines whether a path is external to Drupal.
    *
-   * An example of an external path is http://example.com. If a path cannot be
+   * An example of an external path is https://example.com. If a path cannot be
    * assessed by Drupal's menu handler, then we must treat it as potentially
    * insecure.
    *
    * @param string $path
    *   The internal path or external URL being linked to, such as "node/34" or
-   *   "http://example.com/foo".
+   *   "https://example.com/foo".
    *
    * @return bool
    *   TRUE or FALSE, where TRUE indicates an external path.
@@ -283,9 +283,9 @@ public static function isExternal($path) {
    * Determines if an external URL points to this installation.
    *
    * @param string $url
-   *   A string containing an external URL, such as "http://example.com/foo".
+   *   A string containing an external URL, such as "https://example.com/foo".
    * @param string $base_url
-   *   The base URL string to check against, such as "http://example.com/".
+   *   The base URL string to check against, such as "https://example.com/".
    *
    * @return bool
    *   TRUE if the URL has the same domain and base path.
diff --git a/core/lib/Drupal/Core/Action/Plugin/Action/GotoAction.php b/core/lib/Drupal/Core/Action/Plugin/Action/GotoAction.php
index 92e92e006489852594bb505c821b4eb138d27126..55b746de6cecb45fbeac11bb559d64c1b5b997df 100644
--- a/core/lib/Drupal/Core/Action/Plugin/Action/GotoAction.php
+++ b/core/lib/Drupal/Core/Action/Plugin/Action/GotoAction.php
@@ -116,7 +116,7 @@ public function buildConfigurationForm(array $form, FormStateInterface $form_sta
     $form['url'] = [
       '#type' => 'textfield',
       '#title' => $this->t('URL'),
-      '#description' => $this->t('The URL to which the user should be redirected. This can be an internal URL like /node/1234 or an external URL like @url.', ['@url' => 'http://example.com']),
+      '#description' => $this->t('The URL to which the user should be redirected. This can be an internal URL like /node/1234 or an external URL like @url.', ['@url' => 'https://example.com']),
       '#default_value' => $this->configuration['url'],
       '#required' => TRUE,
     ];
diff --git a/core/lib/Drupal/Core/Asset/LibraryDiscoveryParser.php b/core/lib/Drupal/Core/Asset/LibraryDiscoveryParser.php
index 78097760f493f5a775a56e2877ec922f88f0de79..197d935909deacfc655dfcb72aca91d11755eafc 100644
--- a/core/lib/Drupal/Core/Asset/LibraryDiscoveryParser.php
+++ b/core/lib/Drupal/Core/Asset/LibraryDiscoveryParser.php
@@ -261,7 +261,7 @@ public function buildByExtension($extension) {
             elseif ($this->streamWrapperManager->isValidUri($source)) {
               $options['data'] = $source;
             }
-            // A regular URI (e.g., http://example.com/example.js) without
+            // A regular URI (e.g., https://example.com/example.js) without
             // 'external' explicitly specified, which may happen if, e.g.
             // libraries-override is used.
             elseif ($this->isValidUri($source)) {
@@ -634,7 +634,7 @@ protected function setOverrideValue(array &$library, array $sub_key, array $over
   protected function resolveThemeAssetPath($theme_path, $overriding_asset) {
     if ($overriding_asset[0] !== '/' && !$this->isValidUri($overriding_asset)) {
       // The destination is not an absolute path and it's not a URI (e.g.
-      // public://generated_js/example.js or http://example.com/js/my_js.js), so
+      // public://generated_js/example.js or https://example.com/js/my_js.js), so
       // it's relative to the theme.
       return '/' . $theme_path . '/' . $overriding_asset;
     }
diff --git a/core/lib/Drupal/Core/Cache/Context/SiteCacheContext.php b/core/lib/Drupal/Core/Cache/Context/SiteCacheContext.php
index 16516c5e2f8226829cc9713ac14ceeb774948351..6291c084a3d55f9a8e5569132c62dc85eefdafb6 100644
--- a/core/lib/Drupal/Core/Cache/Context/SiteCacheContext.php
+++ b/core/lib/Drupal/Core/Cache/Context/SiteCacheContext.php
@@ -12,7 +12,7 @@
  * A "site" is defined as the combination of URI scheme, domain name, port and
  * base path. It allows for varying between the *same* site being accessed via
  * different entry points. (Different sites in a multisite setup have separate
- * databases.) For example: http://example.com and http://www.example.com.
+ * databases.) For example: https://example.com and http://www.example.com.
  *
  * @see \Symfony\Component\HttpFoundation\Request::getSchemeAndHttpHost()
  * @see \Symfony\Component\HttpFoundation\Request::getBaseUrl()
diff --git a/core/lib/Drupal/Core/File/FileUrlGenerator.php b/core/lib/Drupal/Core/File/FileUrlGenerator.php
index 3f32d485a69ca6a083c5f078a74516a06053f306..82f080cb96f567571ea547be35dcbc90f34c6de2 100644
--- a/core/lib/Drupal/Core/File/FileUrlGenerator.php
+++ b/core/lib/Drupal/Core/File/FileUrlGenerator.php
@@ -119,9 +119,9 @@ protected function doGenerateString(string $uri, bool $relative): string {
    */
   protected function generatePath(string $base_url, string $uri): string {
     // Allow for:
-    // - root-relative URIs (e.g. /foo.jpg in http://example.com/foo.jpg)
+    // - root-relative URIs (e.g. /foo.jpg in https://example.com/foo.jpg)
     // - protocol-relative URIs (e.g. //bar.jpg, which is expanded to
-    //   http://example.com/bar.jpg by the browser when viewing a page over
+    //   https://example.com/bar.jpg by the browser when viewing a page over
     //   HTTP and to https://example.com/bar.jpg when viewing a HTTPS page)
     // Both types of relative URIs are characterized by a leading slash, hence
     // we can use a single check.
@@ -160,9 +160,9 @@ public function generate(string $uri): Url {
 
     if (!$scheme) {
       // Allow for:
-      // - root-relative URIs (e.g. /foo.jpg in http://example.com/foo.jpg)
+      // - root-relative URIs (e.g. /foo.jpg in https://example.com/foo.jpg)
       // - protocol-relative URIs (e.g. //bar.jpg, which is expanded to
-      //   http://example.com/bar.jpg by the browser when viewing a page over
+      //   https://example.com/bar.jpg by the browser when viewing a page over
       //   HTTP and to https://example.com/bar.jpg when viewing a HTTPS page)
       // Both types of relative URIs are characterized by a leading slash, hence
       // we can use a single check.
diff --git a/core/lib/Drupal/Core/Routing/LocalAwareRedirectResponseTrait.php b/core/lib/Drupal/Core/Routing/LocalAwareRedirectResponseTrait.php
index 521feaf19f93115db43be735681de4f7e07b34dc..1efd5d569f66be809056945a55d379b8dca617f9 100644
--- a/core/lib/Drupal/Core/Routing/LocalAwareRedirectResponseTrait.php
+++ b/core/lib/Drupal/Core/Routing/LocalAwareRedirectResponseTrait.php
@@ -21,7 +21,7 @@ trait LocalAwareRedirectResponseTrait {
    *
    * @param string $url
    *   The internal path or external URL being linked to, such as "node/34" or
-   *   "http://example.com/foo".
+   *   "https://example.com/foo".
    *
    * @return bool
    *   TRUE or FALSE, where TRUE indicates a local path.
diff --git a/core/lib/Drupal/Core/Routing/RequestContext.php b/core/lib/Drupal/Core/Routing/RequestContext.php
index 24f196079b9996080ccbf5620db7f46035220a8d..0f8948da175be7accd8205489585466fd855ea3a 100644
--- a/core/lib/Drupal/Core/Routing/RequestContext.php
+++ b/core/lib/Drupal/Core/Routing/RequestContext.php
@@ -12,7 +12,7 @@
 class RequestContext extends SymfonyRequestContext {
 
   /**
-   * The scheme, host and base path, for example "http://example.com/d8".
+   * The scheme, host and base path, for example "https://example.com/d8".
    *
    * @var string
    */
diff --git a/core/lib/Drupal/Core/Routing/RequestHelper.php b/core/lib/Drupal/Core/Routing/RequestHelper.php
index 23063901a0b2b004ad6a986f8ffa498efbbd16a0..c9dc980aceb78721f503a1a1bdf4275a0d4f2bd8 100644
--- a/core/lib/Drupal/Core/Routing/RequestHelper.php
+++ b/core/lib/Drupal/Core/Routing/RequestHelper.php
@@ -13,8 +13,8 @@ class RequestHelper {
    * Returns whether the request is using a clean URL.
    *
    * A clean URL is one that does not include the script name. For example,
-   * - http://example.com/node/1 is a clean URL.
-   * - http://example.com/index.php/node/1 is not a clean URL.
+   * - https://example.com/node/1 is a clean URL.
+   * - https://example.com/index.php/node/1 is not a clean URL.
    *
    * Unclean URLs are required on sites hosted by web servers that cannot be
    * configured to implicitly route URLs to index.php.
diff --git a/core/lib/Drupal/Core/Url.php b/core/lib/Drupal/Core/Url.php
index 9641284b0754a2321ab4d5a0b404b66ffe6c5bad..cf0c0949182702850bfa0b589784b0fe2e27f35c 100644
--- a/core/lib/Drupal/Core/Url.php
+++ b/core/lib/Drupal/Core/Url.php
@@ -753,7 +753,7 @@ public function setAbsolute($absolute = TRUE) {
    * If this Url object was constructed from a Drupal route or from an internal
    * URI (URIs using the internal:, base:, or entity: schemes), the returned
    * string will either be a relative URL like /node/1 or an absolute URL like
-   * http://example.com/node/1 depending on the options array, plus any
+   * https://example.com/node/1 depending on the options array, plus any
    * specified query string or fragment.
    *
    * @param bool $collect_bubbleable_metadata
diff --git a/core/lib/Drupal/Core/Utility/LinkGeneratorInterface.php b/core/lib/Drupal/Core/Utility/LinkGeneratorInterface.php
index e4c48eed0fc5efe32403a91948216852307d14b0..edfe809c7a03c06fa5c4d786251d1b7e6ef6a2bc 100644
--- a/core/lib/Drupal/Core/Utility/LinkGeneratorInterface.php
+++ b/core/lib/Drupal/Core/Utility/LinkGeneratorInterface.php
@@ -17,7 +17,7 @@ interface LinkGeneratorInterface {
    * $link_generator = \Drupal::service('link_generator');
    * $installer_url = \Drupal\Core\Url::fromUri('base://core/install.php');
    * $installer_link = $link_generator->generate($text, $installer_url);
-   * $external_url = \Drupal\Core\Url::fromUri('http://example.com', ['query' => ['foo' => 'bar']]);
+   * $external_url = \Drupal\Core\Url::fromUri('https://example.com', ['query' => ['foo' => 'bar']]);
    * $external_link = $link_generator->generate($text, $external_url);
    * $internal_url = \Drupal\Core\Url::fromRoute('system.admin');
    * $internal_link = $link_generator->generate($text, $internal_url);
diff --git a/core/lib/Drupal/Core/Utility/UnroutedUrlAssemblerInterface.php b/core/lib/Drupal/Core/Utility/UnroutedUrlAssemblerInterface.php
index 51cdf18853500541b16977d9042cdb6bb30a41f2..5d087cf8b1366d7c559b463dd5ef7e8af3faa10f 100644
--- a/core/lib/Drupal/Core/Utility/UnroutedUrlAssemblerInterface.php
+++ b/core/lib/Drupal/Core/Utility/UnroutedUrlAssemblerInterface.php
@@ -15,7 +15,7 @@ interface UnroutedUrlAssemblerInterface {
    *
    * @param string $uri
    *   A local URI or an external URL being linked to, such as "base:foo"
-   *    or "http://example.com/foo".
+   *    or "https://example.com/foo".
    *   - If you provide a full URL, it will be considered an external URL as
    *     long as it has an allowed protocol.
    *   - If you provide only a local URI (e.g. "base:foo"), it will be
@@ -24,7 +24,7 @@ interface UnroutedUrlAssemblerInterface {
    *     is found) will be added to the path. Additional query arguments for
    *     local paths must be supplied in $options['query'], not part of $uri.
    *   - If your external URL contains a query (e.g.
-   *     http://example.com/foo?a=b), then you can either URL encode the query
+   *     https://example.com/foo?a=b), then you can either URL encode the query
    *     keys and values yourself and include them in $uri, or use
    *     $options['query'] to let this method URL encode them.
    * @param array $options