diff --git a/doc/src/cylc-user-guide/cug.tex b/doc/src/cylc-user-guide/cug.tex
index 6b9d9ef04c6..bc6f8628553 100644
--- a/doc/src/cylc-user-guide/cug.tex
+++ b/doc/src/cylc-user-guide/cug.tex
@@ -381,12 +381,16 @@ \section{Cylc Screenshots}
 \section{Installation}
 \label{Requirements}
 
-Cylc runs on Unix variants, usually Linux, and including Apple OS X.
+Cylc runs on Linux. It is tested quite thoroughly on modern RHEL and Ubuntu
+distros. Some users have also managed to make it work on other Unix variants
+including Apple OS X, but they are not officially tested and supported.
 
 \subsection{Third-Party Software Packages}
 
-{\bf Python \lstinline@>=@ 2.6} is required (but not yet Python 3). Python
-should already be installed in your Linux system. \url{https://python.org}.
+{\bf Python 2 \lstinline@>=@ 2.6} is required.
+{\bf Python 2 \lstinline@>=@ 2.7.9} is recommended for the best security.
+Python 2 should already be installed in your Linux system.
+\url{https://python.org/}.
 
 For Cylc's HTTPS communications layer:
 \begin{myitemize}
diff --git a/lib/cylc/network/httpclient.py b/lib/cylc/network/httpclient.py
index 9feb0ed8e5c..3ec13d67b77 100644
--- a/lib/cylc/network/httpclient.py
+++ b/lib/cylc/network/httpclient.py
@@ -385,8 +385,15 @@ def call_server_impl(self, url, method, payload):
     def _call_server_impl_requests(self, url, method, payload):
         """Call server with "requests" library."""
         import requests
-        from requests.packages.urllib3.exceptions import InsecureRequestWarning
-        warnings.simplefilter("ignore", InsecureRequestWarning)
+        # Filter security warnings from urllib3 on python <2.7.9. Obviously, we
+        # want to upgrade, but some sites have to run cylc on platforms with
+        # python <2.7.9. On those platforms, these warnings serve no purpose
+        # except to annoy or confuse users.
+        if sys.version_info < (2, 7, 9):
+            from requests.packages.urllib3.exceptions import (
+                SecurityWarning, SNIMissingWarning)
+            warnings.simplefilter("ignore", SecurityWarning)
+            warnings.simplefilter("ignore", SNIMissingWarning)
         if self.session is None:
             self.session = requests.Session()