HTTP to HTTPS redirect

Whether http:// sends visitors to https://, and whether it does so with a permanent 301 so search engines move the ranking signals across.

• Help center

Every site still has a plain http:// address: old links, bookmarks and visitors who type the bare domain arrive there. If that address serves the page instead of redirecting, the visit happens unencrypted, and anyone on the same network can read or alter it. Search engines also see two versions of every page.

How SiteScan checks it

The scanner requests http:// on the host without following redirects and reads the answer:

• green: a permanent redirect (301 or 308) to https://;
• amber: the redirect exists but is temporary (302, 303 or 307), so search engines may keep the old address in their index;
• red: no redirect at all, or one that does not lead to HTTPS.

If the plain address answers with an error (4xx or 5xx), the row says “not checked”: a firewall or CDN rule may produce that, so it proves nothing.

How to fix

On nginx, give the port-80 server block a single return 301 https://example.com$request_uri;. On Apache, use Redirect permanent / https://example.com/. Most CDNs have an “Always use HTTPS” switch. Once the redirect works, add HSTS so browsers skip the plain address altogether.