diff --git a/common/sanitize/sanitize.go b/common/sanitize/sanitize.go
index fa35b897e..6f2c081e0 100644
--- a/common/sanitize/sanitize.go
+++ b/common/sanitize/sanitize.go
@@ -29,7 +29,11 @@ func URL(defaultScheme string, defaultPort int, defaultPath string) func(string)
 		if _, port, err := net.SplitHostPort(u.Host); err != nil && defaultPort > 0 {
 			u.Host += fmt.Sprintf(":%d", defaultPort)
 		} else if port == "443" {
-			u.Scheme = "https"
+			if u.Scheme == "ws" {
+				u.Scheme = "wss"
+			} else {
+				u.Scheme = "https"
+			}
 		}
 		if defaultPath != "" && u.Path != defaultPath {
 			u.Path = defaultPath
diff --git a/xfer/app_client.go b/xfer/app_client.go
index 6043ea219..023ceb897 100644
--- a/xfer/app_client.go
+++ b/xfer/app_client.go
@@ -189,7 +189,6 @@ func (c *appClient) controlConnection() (bool, error) {
 	dialer := websocket.Dialer{}
 	headers := http.Header{}
 	c.ProbeConfig.authorizeHeaders(headers)
-	// TODO(twilkie) need to update sanitize to work with wss
 	url := sanitize.URL("ws://", 0, "/api/control/ws")(c.target)
 	conn, _, err := dialer.Dial(url, headers)
 	if err != nil {
@@ -273,7 +272,6 @@ func (c *appClient) pipeConnection(id string, pipe Pipe) (bool, error) {
 	dialer := websocket.Dialer{}
 	headers := http.Header{}
 	c.ProbeConfig.authorizeHeaders(headers)
-	// TODO(twilkie) need to update sanitize to work with wss
 	url := sanitize.URL("ws://", 0, fmt.Sprintf("/api/pipe/%s/probe", id))(c.target)
 	conn, resp, err := dialer.Dial(url, headers)
 	if resp != nil && resp.StatusCode == http.StatusNotFound {