Skip to content

Basics

How to redirect HTTP to HTTPS

Anyone who types your domain without a scheme, or follows an old link, lands on the insecure version. That splits your traffic across two origins for search engines and leaves the plain-text version publicly served.

What 13x checks

This is rule basics.http-redirect in the public registry: HTTP redirects to HTTPS. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Basics
Score weight
8 of the readiness score
Scope
Runs on every audited page
Applies
To every site

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

Redirect all HTTP traffic to HTTPS with a permanent redirect:

nginx code
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://example.com$request_uri;
}

On Vercel, Netlify or Cloudflare this is on by default — if it is not happening, DNS is likely pointing somewhere else.

Once the redirect is confirmed working, add HSTS so browsers stop trying HTTP at all:

Configuration
Strict-Transport-Security: max-age=31536000; includeSubDomains

Add HSTS only after you are certain HTTPS works everywhere, including subdomains. It is difficult to undo.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More basics checks