HTTP doesn't redirect to HTTPS

Check id: http.no_https_redirect · fix effort: medium

What it means

Visitors who type your address without https stay on an unencrypted connection that can be read or tampered with along the way. One redirect rule fixes it.

The technical detail

The http:// chain ends on a non-HTTPS URL. Add a 301 at the server or CDN, then HSTS.

How to fix it

1. Add a 301 redirect from http:// to https:// at the server or CDN.
2. Then add HSTS so browsers skip the insecure hop entirely.