Stop redirecting HTTPS to HTTP

Why it matters

The HTTPS homepage sends visitors back to plain http, so the encrypted connection is thrown away and their traffic is exposed again. It usually means the application believes its address starts with http:// or a redirect rule points the wrong way.

The fix

1. Follow the redirect chain with the command below and note which hop answers with a Location that starts with http://.
2. If the application issues it, set its base URL to https (the site URL or APP_URL style setting of your CMS or framework).
3. If a proxy or load balancer in front of the application terminates HTTPS, the application sees plain http requests. Have the proxy send X-Forwarded-Proto: https and configure the application to trust it.
4. If a web server or CDN rule issues it, change the rule's target to https:// or remove it.

curl -sIL https://example.com/ | grep -iE '^(HTTP/|location:)'

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Serve the site over HTTPS
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS