Check that browsers are redirected from HTTP to HTTPS on Cloudflare
Why it matters
The scanner (a crawler user agent) got the page over plain http while the https site tells browsers to use https for at least a year, and many servers redirect browsers yet answer crawlers over http, which is harmless. If browsers get the page over http too, a first-time visitor can be read or changed on the network.
The fix
- Open SSL/TLS, Edge Certificates and turn on Always Use HTTPS. It redirects every http request on proxied hosts to https, whatever the user agent.
- Check with curl -sI http://example.com/ that a request without a browser user agent is redirected too.
The examples use example.com. Replace it with your own domain.
Related
- Reported by the HTTP to HTTPS redirect check
- Serve the site over HTTPS
- Stop redirecting HTTPS to HTTP
- Redirect HTTPS straight to the other host's HTTPS page
- Redirect HTTP to HTTPS
- Redirect HTTP to HTTPS instead of answering an error
- Fix the broken HTTPS redirect chain
- Shorten the redirect chain
- Fix the HTTP redirect chain
- Redirect HTTP straight to HTTPS
- Answer HTTP with a redirect to HTTPS
- Redirect www and apex to one host
- Make the www or apex name work over HTTPS
Scan your domain to see whether this applies to you.