diff --git a/adm/style/banhammer_body.html b/adm/style/banhammer_body.html
index fcc8f1b..fba3bd2 100644
--- a/adm/style/banhammer_body.html
+++ b/adm/style/banhammer_body.html
@@ -75,6 +75,15 @@ <h1>{L_ACP_BH_SETTINGS}</h1>
 				<!-- ENDIF -->
 			</dd>
 		</dl>
+		<!-- IF SFS_CURL -->
+		<dl>
+			<dt><label for="sfs_allow_http">{L_SFS_ALLOW_HTTP}{L_COLON}</label><br /><span>{L_SFS_ALLOW_HTTP_EXPLAIN}</span></dt>
+			<dd>
+				<label><input type="radio" class="radio" name="sfs_allow_http" value="1" <!-- IF SFS_ALLOW_HTTP -->id="sfs_allow_http" checked="checked"<!-- ENDIF -->/> {L_YES}</label> &nbsp;
+				<label><input type="radio" class="radio" name="sfs_allow_http" value="0" <!-- IF not SFS_ALLOW_HTTP -->id="sfs_allow_http" checked="checked"<!-- ENDIF -->/> {L_NO}</label>
+			</dd>
+		</dl>
+		<!-- ENDIF -->
 
 		<p class="submit-buttons">
 			<input class="button1" type="submit" id="submit" name="submit" value="{L_SUBMIT}" />&nbsp;
diff --git a/controller/admin_controller.php b/controller/admin_controller.php
index 0da6c55..1a1ade8 100644
--- a/controller/admin_controller.php
+++ b/controller/admin_controller.php
@@ -109,8 +109,9 @@ public function display_options()
 			'DEL_PROFILE'	=> (!empty($this->config['bh_del_profile'])) ? true : false,
 			'DEL_SIGNATURE'	=> (!empty($this->config['bh_del_signature'])) ? true : false,
 			'MOVE_GROUP'	=> $this->get_groups($this->request->variable('move_group', $this->config['bh_group_id'])),
-			'SFS_API_KEY'	=> (!empty($this->config['bh_sfs_api_key'])) ? $this->config['bh_sfs_api_key'] : '',
-			'SFS_CURL'		=> (function_exists('curl_init')) ? true : false,
+			'SFS_ALLOW_HTTP'	=> (!empty($this->config['bh_sfs_allow_http'])) ? true : false,
+			'SFS_API_KEY'		=> (!empty($this->config['bh_sfs_api_key'])) ? $this->config['bh_sfs_api_key'] : '',
+			'SFS_CURL'			=> (function_exists('curl_init')) ? true : false,
 
 			'U_ACTION'		=> $this->u_action,
 		));
@@ -133,6 +134,7 @@ protected function set_options()
 		$this->config->set('bh_del_signature', $this->request->variable('del_signature', 0));
 		$this->config->set('bh_group_id', $this->request->variable('move_group', 0));
 		$this->config->set('bh_sfs_api_key', $this->request->variable('sfs_api_key', '', true));
+		$this->config->set('bh_sfs_allow_http', $this->request->variable('sfs_allow_http', 0));
 		$this->config->set('bh_ban_time', $this->request->variable('ban_time', 0));
 	}
 
diff --git a/event/banhammer_listener.php b/event/banhammer_listener.php
index df8c1c8..eb02142 100644
--- a/event/banhammer_listener.php
+++ b/event/banhammer_listener.php
@@ -416,8 +416,10 @@ public function do_ban_hammer_stuff($event)
 
 		if ($this->request->variable('sfs_report', 0) && !empty($this->config['bh_sfs_api_key']) && $curl_exists)
 		{
-			// add the spammer to the SFS database
-			$http_request = 'https://www.stopforumspam.com/add.php';
+			// add the spammer to the SFS database. HTTPS unless the admin
+			// has explicitly opted into HTTP for it in the ACP.
+			$sfs_scheme = (!empty($this->config['bh_sfs_allow_http'])) ? 'http://' : 'https://';
+			$http_request = $sfs_scheme . 'www.stopforumspam.com/add.php';
 			$http_request .= '?username=' . urlencode($this->data['username']);
 			$http_request .= '&ip_addr=' . urlencode($this->data['user_ip']);
 			$http_request .= '&email=' . urlencode($this->data['user_email']);
diff --git a/language/en/banhammer_acp.php b/language/en/banhammer_acp.php
index d6001c4..54b10df 100644
--- a/language/en/banhammer_acp.php
+++ b/language/en/banhammer_acp.php
@@ -49,6 +49,8 @@
 	'ACP_MOVE_GROUP'			=> 'Move to group',
 	'ACP_MOVE_GROUP_EXPLAIN'	=> 'Name of the group to which banned users should be moved. This will also be their default group.<br /><strong>If nothing but <em>“No group specified.”</em> is in the drop down then you have not set up any groups.</strong>',
 	'BAN_LENGTH_EXPLAIN'	=> 'If either of the ban options is set then the user will be banned for the amount of time as set here.  This is also able to be set when ban hammering the user.',
+	'SFS_ALLOW_HTTP'		=> 'Allow HTTP for Stop Forum Spam reports',
+	'SFS_ALLOW_HTTP_EXPLAIN'	=> 'Reports are sent over HTTPS by default. <strong>Only enable this if your server cannot make outbound HTTPS requests</strong> - your API key and the reported user\'s username, IP address, and email are sent in clear text over HTTP.',
 	'SFS_API_KEY'			=> 'SFS API key',
 	'SFS_API_KEY_EXPLAIN'	=> 'If you want to report spammers automatically to StopForumSpam you need an API key, <a href="http://www.stopforumspam.com/signup">http://www.stopforumspam.com/signup</a>.',
 	'SFS_NEEDS_CURL'		=> '<span style="color:red;">Your server needs cURL installed to use the stop forum spam service.</span>',
diff --git a/migrations/v105_data.php b/migrations/v105_data.php
new file mode 100644
index 0000000..4d3ac5d
--- /dev/null
+++ b/migrations/v105_data.php
@@ -0,0 +1,32 @@
+<?php
+/**
+ *
+ * Ban Hammer extension for the phpBB Forum Software package
+ *
+ * @copyright (c) 2026, phpBB Modders, https://www.phpbbmodders.com/
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ */
+
+namespace phpbbmodders\banhammer\migrations;
+
+/**
+* Primary migration
+*/
+
+class v105_data extends \phpbb\db\migration\container_aware_migration
+{
+	static public function depends_on()
+	{
+		return array('\phpbbmodders\banhammer\migrations\v104_data');
+	}
+
+	public function update_data()
+	{
+		return array(
+			// Off by default: the Stop Forum Spam report uses HTTPS unless
+			// an admin explicitly opts into HTTP in the ACP.
+			array('config.add', array('bh_sfs_allow_http', 0)),
+		);
+	}
+}