Redirect HTTP straight to HTTPS on nginx

Why it matters

The first redirect from http:// goes to another http:// address, so the visitor's request travels unencrypted twice before reaching https. The name the visitor typed also never gets an HSTS header, which is only honoured over https.

The fix

1. Use one port 80 server for both names that redirects to https on the host that was requested; the https server then sends the non-canonical name to the canonical one. Run sudo nginx -t and reload.

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Serve the site over HTTPS
• Stop redirecting HTTPS to HTTP
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS