Skip to content
DomainGrade

What we checkCertificate & HTTPSTL-06

HTTP redirects to HTTPS

A request to port 80 should redirect permanently to the HTTPS version of the same page.

Area
Certificate & HTTPS
Check
TL-06
Included
Free in every scan

What we check

We request your homepage over plain HTTP and follow what comes back.

Why it matters

Visitors who type your domain without a scheme, or follow an old link, arrive on port 80 first. Anything served there travels in the clear and can be modified in transit.

The redirect is also what makes HSTS possible: the browser has to reach your HTTPS site once to receive the header.

It also matters for what the visitor typed. Someone who types your domain into an address bar sends a plain-HTTP request whatever your site does, and the redirect is the only thing that moves them onto an encrypted connection before they see anything.

How to fix it

  1. 1

    Return a 301 to the HTTPS URL for every path, not just the homepage.

  2. 2

    Do not serve real content over HTTP as a fallback.

Redirecting everything to HTTPS
nginx:   return 301 https://$host$request_uri;
Apache:  Redirect permanent / https://yourcompany.com/

Common questions

Should it be 301 or 302?
301. It is permanent, browsers cache it, and search engines treat the HTTPS URL as canonical.
Can I just close port 80?
You can, but a visitor typing your domain then gets a connection error rather than your site. The redirect is friendlier and no less secure.
Does the redirect need to preserve the path?
Yes. Redirecting every HTTP request to the homepage loses whatever the visitor was actually trying to reach.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other certificate & https checks