Stop redirecting HTTPS to HTTP on nginx

Why it matters

The HTTPS homepage sends visitors back to plain http, so the encrypted connection is thrown away and their traffic is exposed again. It usually means the application believes its address starts with http:// or a redirect rule points the wrong way.

The fix

1. Search the configuration for redirects to http (grep -rn 'http://' /etc/nginx) and change any return or rewrite in the port 443 server to https://.
2. If nginx proxies to an application, pass the original scheme so the application builds https URLs, then run sudo nginx -t and reload.

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Serve the site over HTTPS
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS