HTTP not redirecting to HTTPS

Every visitor who reaches the HTTP version transmits everything in clear, including whatever they type into a form.

Cookies without the Secure attribute are sent on those requests, which means a session cookie can be captured on the network.

Search engines can index both versions, splitting ranking signals between two URL sets for identical content.

Browsers mark the HTTP version as not secure in the address bar, which visitors notice.

Any absolute HTTP link inside the page keeps visitors on the insecure version for the rest of their session.

A 301 permanent redirect, which tells search engines the HTTPS URL is the one that counts and is cached by browsers.

Preserving the path and the query string, so a deep link reaches the same page rather than the home page.

From every hostname the site answers on, including the www variant and any alias.

In one hop. A chain from HTTP to the HTTPS home page to the HTTPS deep page is slower and loses the original path along the way.

At the earliest layer that can do it — a load balancer or an edge rule rather than the application — so it applies before any application logic runs.

Certificate renewal using HTTP validation serves a file at a well-known path over plain HTTP.

A blanket redirect applied before that path is excluded breaks renewal, and the breakage is silent until the certificate expires weeks later.

So the redirect rule needs an exception for that path, which every ACME client's documentation describes.

This is the single most common cause of a renewal that worked for a year and then stopped.

Switching to DNS validation removes the question entirely, at the cost of a DNS API credential to maintain.

Update internal links to HTTPS rather than relying on the redirect, since every redirected request is a wasted round trip.

Add the Secure attribute to cookies, which is only safe once HTTP no longer serves the site.

Consider HSTS, which removes the initial HTTP request entirely for returning visitors — after verifying every hostname serves valid HTTPS.

Update the canonical tags and the sitemap to HTTPS URLs so the two agree with the redirect.

Keep the redirect permanently. HSTS applies only to browsers that have seen the header; the redirect serves everyone else.

`curl -I http://example.com` should return a 301 with a Location header naming the HTTPS URL.

`curl -I http://example.com/some/deep/page` should redirect to the same path, not to the home page.

Test the www variant separately — it is a different hostname and frequently a different rule.

Follow the chain with `curl -IL` and count the hops: more than one before reaching the final HTTPS URL is worth simplifying.

Confirm the ACME validation path is still reachable over HTTP if you use that method.

`transport.http_redirect` reports whether plain HTTP requests are redirected to HTTPS, which is this problem directly.

`transport.https` reports whether HTTPS works at all, so a site with no certificate is distinguished from one that simply does not redirect.

`transport.canonical_host` reports whether the www and non-www variants resolve to one canonical form.

`transport.redirect_chain` reports the hops, since a redirect that works through three steps is a different finding from one that does not exist.

`transport.hsts` is reported alongside, because the redirect is the prerequisite for deploying it safely.

A meta refresh or a JavaScript location change happens after the page has already been served over HTTP.

Which means the insecure request completed, the response crossed the network, and anything in it was readable.

Search engines treat them inconsistently and do not reliably pass ranking signals through them.

They also fail entirely for clients that do not execute scripts, which includes a meaningful share of automated traffic.

The redirect has to be a status code from the server, before any content is sent.