How to enforce HTTPS
Security1 min readFixes 2 checks https-enforced, http-to-https-redirect
HTTPS encrypts traffic and is a ranking signal. Every http:// request should redirect permanently to https://.
Step by step, with screenshots: Caddy: the two-line https server and the headers to add to it →
Check your own site
Runs these 2 checks and the other 185, free, in about 45 seconds.
What a passing site looks like
- The site is served over HTTPSfail · −15 ptseffort M
- http:// redirects to https://fail · −8 ptseffort S
1. The site is served over HTTP, not HTTPS
Why it matters. Browsers label HTTP pages "Not secure" and Google uses HTTPS as a small ranking signal. Anyone on the network can read or alter what visitors see.
How to fix it.
- Get a certificate (Let's Encrypt is free) and enable HTTPS on your host.
- Redirect every http:// URL to https:// with a 301.
2. http:// does not redirect to https://
Why it matters. Visitors who type your address without https, or follow an old link, land on the unencrypted page. Every one of those visits can be read or altered on the network.
How to fix it.
- Redirect every http:// URL to the same path on https:// with a 301.
- nginx: return 301 https://$host$request_uri; Apache: RewriteRule in .htaccess; most hosts and Cloudflare have a "Always use HTTPS" switch.