Check 22 of 23 · Does it deliver?

Plain http sends people to https

When someone types your address without the "s," your site should forward them to the secure version. Otherwise your pages live at two addresses.

  • Who fixes itYou can do this
  • TimeAbout 10 minutes
  • Worth2 of 100 points
  • How sure we areLikely

What this is

Your site has a secure address, https://yourbusiness.com. But people and robots still sometimes ask for the old one, http://yourbusiness.com, without the “s.”

A redirect is a forwarding note. When a request comes in for the http address, the server answers “moved, go here” and sends it to the https address. The visitor never notices. The technical name for a permanent forward is a “301 redirect.”

Why it matters to you

Without the redirect, your site can answer on both addresses. It is the same page with two front doors. Anything that counts links or citations sees two smaller sites instead of one bigger one.

This is a 2-point check. If you already pass Your site uses https, most of the work is done and this is the last tidy-up.

What we look for

We ask for your homepage at http:// and watch what happens.

  • Pass: the request ends up at an https:// address.
  • Warn (small): http:// does not answer at all. You keep most of the points. A closed door is fine, though a forward is friendlier.
  • Warn (larger): http:// serves your page without forwarding. The same page now exists at two addresses. You keep a few points.

There is no fail on this check.

Whether you can fix this yourself

Yes, usually. On most hosts the redirect is a checkbox next to the https switch.

Wix, Squarespace, Shopify and SimplePractice all forward http to https on their own once your domain is connected. If you are on one of those and see the larger warn, the domain connection is not finished. See the https article above.

How to fix it

WordPress

  1. In your host’s control panel, look for “Force HTTPS” or “HTTPS redirect.” Turn it on. Many hosts (SiteGround, Bluehost, Kinsta, WP Engine) have this switch.
  2. If your host has no switch, the plugin Really Simple SSL adds the redirect for you.
  3. If you are behind Cloudflare, SSL/TLS, then Edge Certificates, then “Always Use HTTPS.” Turn it on.

Squarespace or Wix

There is nothing to do once your domain shows as connected and secure. If it is not, search your platform’s help for “connect domain.”

Shopify

There is nothing to do once the SSL status on your domain reads “Active.”

Your own site or a developer

Redirect http to https with a 301. On Apache, in .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Nginx, a separate server block on port 80 with return 301 https://$host$request_uri;.

How to check it worked

Type your address into the browser with http:// on the front and no “s.” Press Enter. Watch the address bar. It should change to https:// on its own. Then run the free check again.

Do not worry about

If http:// simply does not load at all, you lose a fraction of a point and nothing else. Some hosts close port 80 on purpose. It is not a problem to chase unless you have nothing else left to fix.