Skip to content
DomainGrade

What we checkCertificate & HTTPSTL-06

Your site is served over plain HTTP

Content is returned on port 80 instead of being redirected to HTTPS.

Area
Certificate & HTTPS
Check
TL-06
Included
Free in every scan

What we check

We requested your homepage over HTTP and got content rather than a redirect.

Why it matters

Everything on the page — what the visitor reads, what they type, the session cookie — travels in the clear and can be read or altered by anyone on the path.

Browsers also mark the page as not secure, which visitors notice.

Search engines have also treated HTTPS as a ranking signal for years, and browsers now label its absence in the address bar — so the cost is not only the interception risk but the visible impression the site gives.

How to fix it

  1. 1

    Get a certificate; Let's Encrypt issues them free and most platforms automate it.

  2. 2

    Redirect every HTTP request to the HTTPS version of the same URL with a 301.

  3. 3

    Then add HSTS.

Redirecting everything to HTTPS
nginx:   return 301 https://$host$request_uri;
Apache:  Redirect permanent / https://yourcompany.com/

Common questions

My site is just brochure pages. Does it matter?
Yes. Without HTTPS anyone on the path can modify what your visitors see — inserting a phone number, a bank detail, a download.
Is a certificate expensive?
No. Let's Encrypt is free and most hosts set it up for you in a click.
Will it hurt my search ranking?
The opposite. HTTPS has been a ranking signal for years, and browsers label its absence.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other certificate & https checks