Stop redirecting HTTPS to HTTP on Netlify
Why it matters
The HTTPS homepage sends visitors back to plain http, so the encrypted connection is thrown away and their traffic is exposed again. It usually means the application believes its address starts with http:// or a redirect rule points the wrong way.
The fix
- Check _redirects and the [[redirects]] entries in netlify.toml for destinations that start with http:// and change them to https://.
- Check functions or framework code that build absolute URLs, then redeploy.
Related
- Reported by the HTTP to HTTPS redirect check
- Serve the site over HTTPS
- Redirect HTTP to HTTPS
- Fix the broken HTTPS redirect chain
- Shorten the redirect chain
- Fix the HTTP redirect chain
- Redirect HTTP straight to HTTPS
- Answer HTTP with a redirect to HTTPS
- Redirect www and apex to one host
- Make the www or apex name work over HTTPS
Scan your domain to see whether this applies to you.