HTTPS Enforcement Check

Having a valid certificate is only half the job — you also have to make sure visitors actually use it. If your site answers on plain http:// without redirecting, attackers on the same network can read or modify traffic before the browser ever upgrades to HTTPS. VitalSite checks whether HTTP is properly redirected to HTTPS and inspects the entire redirect chain.

What VitalSite checks

• Does HTTP redirect to HTTPS? We request the plain-HTTP version of your homepage and follow what happens.
• Is it a 301 (permanent) redirect? A 301 is preferred over a 302 (temporary). 301s are cached by browsers, are eligible for HSTS preloading, and pass SEO authority cleanly.
• Redirect chain health. We follow the full chain to detect redirect loops, unnecessary hops, and chains that briefly drop back to HTTP.

If port 80 is simply closed (an HTTPS-only posture), that's also acceptable and VitalSite records it as a pass.

Why it matters

The first request to a website is often over HTTP — a user types "example.com" and the browser tries HTTP first. Without a redirect, that initial request travels unencrypted and is vulnerable to interception and SSL-stripping attacks. A clean, permanent redirect closes that gap for every visitor.

How to fix it

Nginx — redirect all HTTP traffic permanently:

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

Apache — use mod_rewrite or a Redirect directive. Cloudflare — enable "Always Use HTTPS" in the SSL/TLS app. Vercel/Netlify — HTTPS redirects are automatic.

Once the redirect is in place, add HSTS so the browser remembers to use HTTPS and skips the insecure first hop entirely on future visits. Pair this with a healthy SSL/TLS certificate for end-to-end coverage.

Verify the fix

Re-scan your domain. The HTTPS Enforcement check should report a permanent 301 redirect with no loops. If you still see a 302, switch it to a 301 to unlock HSTS preload eligibility and cleaner SEO.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.