Stop redirecting HTTPS to HTTP on Vercel
Why it matters
The HTTPS homepage sends visitors back to plain http, so the encrypted connection is thrown away and their traffic is exposed again. It usually means the application believes its address starts with http:// or a redirect rule points the wrong way.
The fix
- Vercel never serves plain http, so the redirect comes from your project. Check the redirects in vercel.json and in your framework config for destinations that start with http://.
- Check application code or middleware that builds absolute URLs, change them to https://, and redeploy.
Related
- Reported by the HTTP to HTTPS redirect check
- Serve the site over HTTPS
- Redirect HTTP to HTTPS
- Fix the broken HTTPS redirect chain
- Shorten the redirect chain
- Fix the HTTP redirect chain
- Redirect HTTP straight to HTTPS
- Answer HTTP with a redirect to HTTPS
- Redirect www and apex to one host
- Make the www or apex name work over HTTPS
Scan your domain to see whether this applies to you.