HTTP Does Not Redirect to HTTPS: How to Force HTTPS

Http no redirect

HTTP Does Not Redirect to HTTPS: How to Force HTTPS

Your http pages load without forcing https. Add one 301 redirect that sends every http request…
Learn More
Javascript via cdn without subresource integrity

JavaScript via CDN without Subresource Integrity: How to Fix It

Your pages load JavaScript from a CDN, but those script tags have no integrity attribute. That…
Learn More
Https form posts to http

HTTPS Form Posts to HTTP: How to Fix the Insecure Form

A form on an HTTPS page that posts to an HTTP endpoint sends user data over…
Learn More
Diagram showing an insecure http url 301 redirecting to its https equivalent, with apache and nginx redirect rules and an hsts response header.

Internal HTTP URLs

Best practices guide for Internal HTTP URLs (SE-013). Priority: High. Batch check required.
Learn More
Server information leakage

Server Information Leakage: How to Stop Exposing Your Stack

Your server is announcing what software it runs and which version, through headers like Server, X-Powered-By,…
Learn More
X-xss-protection header missing: what to do in 2026

X-XSS-Protection Header Missing: What to Do in 2026

The X-XSS-Protection header is deprecated and ignored by every modern browser, so the real fix is…
Learn More

Get new blog posts by email: