HTTPS and HTTP-to-HTTPS Redirects

What the problem looks like

How DNS Panopticon detects it

Security Posture loads your homepage the way a browser would and records whether it ended up on HTTPS. It then sends one extra request to the plain http:// address and checks whether the answer redirects to https://. Both results appear on the Website Application Security card.

Only the homepage is checked. A site can pass here and still have individual pages or subdomains on plain HTTP, so check the important ones yourself.

How to check it yourself

In a browser, look at the address bar. Chrome, Edge and Firefox show “Not secure” or a crossed-out padlock for plain HTTP pages. To see the redirect, use curl, which ships with Windows 10 and later, macOS and Linux.

Why it matters

• Eavesdropping. On plain HTTP, everything a visitor sends and receives, including form fields, cookies and the pages they read, crosses the network in readable form.
• Tampering. Hotspots, compromised routers and some ISPs have injected ads, tracking or malware into HTTP pages. HTTPS makes any change detectable, so the browser drops the connection instead of showing altered content.
• Session theft. A login cookie sent over HTTP can be copied and replayed to take over the account.
• Browser warnings. Browsers label HTTP pages “Not secure”, and many features, such as geolocation, service workers and some payment APIs, only work on secure pages.
• Trust and search. Visitors notice the warning, and Google has used HTTPS as a ranking signal since 2014.

The redirect matters because people rarely type https://. Old bookmarks, printed material and links on other sites often use http://. Without a redirect, each of those visits starts unencrypted.

How to fix it

1. Get a certificate. Most hosts, CDNs and platforms (Cloudflare, Netlify, GitHub Pages, Squarespace, Shopify, Azure App Service, AWS CloudFront) issue and renew certificates for you once the domain points at them. On your own server, use an ACME client such as Certbot with Let’s Encrypt, which renews automatically.
2. Serve the site on port 443 with that certificate, for the bare domain and for www if you use it.
3. Redirect all http:// requests with a 301 or 308 to the same host and path on https://. Redirect to the same host first; if you also move between www and the bare domain, do it on HTTPS.
4. Fix internal links and canonical tags to use https://, so pages do not bounce through redirects or load mixed content.
5. Add HSTS once everything works, so browsers stop trying http:// at all. See HSTS: HTTP Strict Transport Security.

Typical redirect settings:

An nginx example that serves HTTPS and redirects everything else:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

You can also publish a CAA record that names the certificate authority you use, so other authorities refuse to issue certificates for your domain.