Redirect HTTP straight to HTTPS

Why it matters

The first redirect from http:// goes to another http:// address, so the visitor's request travels unencrypted twice before reaching https. The name the visitor typed also never gets an HSTS header, which is only honoured over https.

The fix

1. Make the first redirect from http go to https on the same host, then redirect to the canonical host over https if it differs, for example http://example.com/ to https://example.com/ to https://www.example.com/.
2. Check every http entry point (apex and www) with curl -sI and confirm the first Location starts with https://.

GET / HTTP/1.1
Host: example.com

HTTP/1.1 301 Moved Permanently
Location: https://example.com/

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Serve the site over HTTPS
• Stop redirecting HTTPS to HTTP
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS