Web security
HTTP redirects to HTTPS
Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.
Why it matters
Visitors who type the bare address land on the unencrypted version of the site, where logins can be intercepted and pages tampered with.
How to fix it
Quick fix · under 1 hour- Add a permanent (301) redirect from HTTP to HTTPS for every host name.
- Reload the web server and re-run the scan to confirm.
nginx
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Apache (.htaccess)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]How we test it
The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.
Does your domain pass this check?
Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.
Scan your domain free