HTTP Does Not Redirect to HTTPS: How to Force HTTPS

What this check flags

The crawler requested the http version of your pages and got a normal page back instead of a redirect to https. That means both http://yourdomain.com and https://yourdomain.com serve live content. A secure certificate sitting on the server does nothing if the insecure version still answers. The fix is to force every http request to the matching https URL with a permanent (301) redirect, applied site-wide rather than page by page.

Why you want to force https

Three separate problems stack up when http stays open:

Security. Anything loaded over http travels in plain text. On shared or public networks, a third party between the visitor and your server can read or alter the page, including form input and session cookies. The padlock only protects requests that actually use https.

Duplicate content. When the same page resolves on both protocols, search engines see two URLs with identical content. A 301 redirect is the standard way to consolidate duplicate versions onto the single canonical URL, so ranking signals point at one address instead of being split. This is closely tied to the URL works on HTTP and HTTPS check, which flags the same root cause from the indexation angle.

Browser warnings. Modern browsers mark http pages as "Not secure" in the address bar. Visitors who see that warning bounce. Forcing https removes the label and keeps you clear of the broken-padlock mixed content warnings that appear when a secure page pulls in insecure assets.

How to fix it

Redirect every http request to https with a single permanent rule that covers the whole host, preserving the path and query string. Do not list pages one at a time.

Nginx. A dedicated port 80 server block that returns a 301 is the fastest approach because it skips regex processing:

server {
    listen 80;
    listen [::]:80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

Apache. If you are on Apache with mod_rewrite, this lives in your .htaccess or vhost:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

The $host / %{HTTP_HOST} and $request_uri / %{REQUEST_URI} tokens carry the original hostname and full path forward, so a visitor landing on a deep page reaches the exact https version of that page in one move.

Then add HSTS, and the order matters

Once the redirect is solid, add an HSTS header so browsers refuse http for your domain before they ever send a request. The order is not optional. The plain http response that performs the redirect must not carry the Strict-Transport-Security header, because that header is only valid over https. Send it on the https responses instead.

Nginx (inside the https server block):

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Apache:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Add the preload directive and submit to the preload list only after the redirect and header have run cleanly for a while. Once a domain is preloaded, browsers ship it baked in, and backing out is slow and painful. The RFC 6797 baseline for preload eligibility is a max-age of at least 31536000 seconds (one year) plus includeSubDomains, so be certain every subdomain answers on https before you commit.

How to diagnose it

Check the http response headers from the command line:

curl -I http://yourdomain.com/some-page/

A correct setup returns HTTP/1.1 301 Moved Permanently and a Location: header pointing at the https version of the same path. If you get a 200 OK, the http page is still serving and the redirect is missing. Run the same test against a deep URL with a query string, not just the homepage, to confirm the path is preserved.

Common mistakes

Redirect chains. A request that goes http to https-non-www to https-www burns extra round trips and dilutes the redirect's value. Aim for a single hop: http straight to the final canonical https URL. Test with curl -IL and count the redirects.

Only the homepage redirects. A rule written for the root path leaves every inner page open on http. Your redirect must match all paths, which is what the site-wide patterns above do.

HSTS on the http response. Sending the Strict-Transport-Security header on the insecure redirect itself is invalid and gets ignored. Keep it on https responses only.

Using a 302. A temporary redirect tells search engines the move is not permanent, so signals do not consolidate. Use 301.

FAQ