HTTP to HTTPS redirectsWhat it checks and how to fix it

What it checks

Requests the http:// version of the site root. Passes when it answers with a 3xx redirect whose Location starts with https://, fails when it serves the page over plain HTTP (200) or redirects somewhere that is not HTTPS, and warns on any other status.

Why it matters

Visitors who type your domain without https://, and old links, land on plain HTTP, where everything they send and receive can be read and modified on the network. Serving both versions also splits ranking signals between two copies of every page. A permanent redirect to HTTPS is also a prerequisite for HSTS.

How to fix it

Answer every plain-HTTP request with a permanent (301) redirect to the same path on HTTPS.

# nginx
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

# Apache
<VirtualHost *:80>
  ServerName example.com
  ServerAlias www.example.com
  Redirect permanent / https://example.com/
</VirtualHost>

# Rails: config/environments/production.rb
config.force_ssl = true
# Behind a proxy or load balancer that terminates TLS, also:
config.assume_ssl = true

Cloudflare: SSL/TLS → Edge Certificates → turn on "Always Use HTTPS".

curl -sI http://example.com