Check that browsers are redirected from HTTP to HTTPS

headers.redirect.no_redirect_crawler · effort: minutes

Why it matters

The scanner (a crawler user agent) got the page over plain http while the https site tells browsers to use https for at least a year, and many servers redirect browsers yet answer crawlers over http, which is harmless. If browsers get the page over http too, a first-time visitor can be read or changed on the network.

The fix

  1. Request the page the way a browser does: curl -sI -A 'Mozilla/5.0' http://example.com/ . A 301 or 308 to https:// means visitors are fine and nothing needs to change.
  2. If the browser request also answers 200, make the port 80 site answer every request with a 301 redirect to the same host and path on https://, whatever the user agent.
  3. If the site is behind Cloudflare or another CDN that connects to this server over plain http (Cloudflare Flexible mode), this redirect loops. Switch the CDN to Full (strict) first, or redirect at the CDN instead (Always Use HTTPS).
bash 
curl -sI -A 'Mozilla/5.0' http://example.com/ | head -n 3
# expected: HTTP/1.1 301 Moved Permanently
#           Location: https://example.com/

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.