diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 3.0.1.3
+
+[Unable to allow insecure connections with warp-tls #324](https://github.com/yesodweb/wai/issues/324)
+
 ## 3.0.1.2
 
 [Make sure Timer is tickled in sendfile. #323](https://github.com/yesodweb/wai/pull/323)
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -208,7 +208,7 @@
         TLS.backendFlush = return ()
       , TLS.backendClose = sClose s
       , TLS.backendSend  = sendAll s
-      , TLS.backendRecv  = getNext cachedRef s
+      , TLS.backendRecv  = recvTLS cachedRef s
       }
     conn ctx readBuf writeBuf = Connection {
         connSendMany         = TLS.sendData ctx . L.fromChunks
@@ -222,7 +222,7 @@
       , connBufferSize       = bufferSize
       }
       where
-        sendfile fp offset len tickle headers = do
+        sendfile fp offset len tickle' headers = do
             TLS.sendData ctx $ L.fromChunks headers
             IO.withBinaryFile fp IO.ReadMode $ \h -> do
                 IO.hSeek h IO.AbsoluteSeek offset
@@ -234,7 +234,7 @@
                 unless (B.null bs) $ do
                     let x = B.take remaining bs
                     TLS.sendData ctx $ L.fromChunks [x]
-                    tickle -- This tickles the Timer.  It MUST be called per chunk.
+                    void $ tickle' -- This tickles the Timer.  It MUST be called per chunk.
                     loop h $ remaining - B.length x
 
         close = freeBuffer readBuf `finally`
@@ -263,7 +263,10 @@
 plainHTTP TLSSettings{..} s cachedRef = case onInsecure of
     AllowInsecure -> do
         conn' <- socketConnection s
-        return (conn' { connRecv = getNext cachedRef s 4096 }, False)
+        let conn'' = conn'
+                { connRecv = recvPlain cachedRef (connRecv conn')
+                }
+        return (conn'', False)
     DenyInsecure lbs -> do
         sendAll s "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\n"
         mapM_ (sendAll s) $ L.toChunks lbs
@@ -272,8 +275,8 @@
 
 ----------------------------------------------------------------
 
-getNext :: I.IORef B.ByteString -> Socket -> Int -> IO B.ByteString
-getNext cachedRef s size = do
+recvTLS :: I.IORef B.ByteString -> Socket -> Int -> IO B.ByteString
+recvTLS cachedRef s size = do
     cached <- I.readIORef cachedRef
     loop cached
   where
@@ -289,6 +292,20 @@
             return bs1
           else
             loop $ B.append bs1 bs2
+
+----------------------------------------------------------------
+
+-- | Modify the given receive function to first check the given @IORef@ for a
+-- chunk of data. If present, takes the chunk of data from the @IORef@ and
+-- empties out the @IORef@. Otherwise, calls the supplied receive function.
+recvPlain :: I.IORef B.ByteString -> IO B.ByteString -> IO B.ByteString
+recvPlain ref fallback = do
+    bs <- I.readIORef ref
+    if B.null bs
+        then fallback
+        else do
+            I.writeIORef ref B.empty
+            return bs
 
 ----------------------------------------------------------------
 
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.0.1.2
+Version:             3.0.1.3
 Synopsis:            HTTP over SSL/TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE