Should the redirect be a 301 or a 302?

A permanent one: 301, or 308 when the request method must be kept. Browsers cache it, and search engines move the ranking of the http:// URL to the https:// one. A 302 tells them the move is temporary.

Is a redirect enough on its own?

No. The first request still goes out over plain HTTP, where it can be intercepted before the redirect arrives. Add an HSTS header so returning browsers go straight to HTTPS.

What does EngineeringScore check?

It requests the http:// address of the page and looks for a redirect to https://. When it cannot observe the answer, the check is reported as not determined instead of passed.

What can break after switching?

Scripts, images and styles still linked with http:// become mixed content on the HTTPS page, and browsers block or warn about them. Update those links in the same change.

Best Practices Small

Redirect HTTP to HTTPS: Nginx, Apache and more

Redirect HTTP to HTTPS

Even after HTTPS is available, visitors and search engines who land on the plain-HTTP URL (from an old link, a bookmark, or a direct type-in) will stay there unless the server actively redirects them. Without that redirect, the insecure version keeps getting used indefinitely, and SEO authority can end up split between the HTTP and HTTPS versions of the same content.

Find out whether your site has this problem, and every other check, in one free scan.

Check your site free

Why it matters

If HTTP requests aren't redirected, visitors and search engines who land on the insecure URL stay on it, exposing them to interception and splitting SEO signal between the HTTP and HTTPS versions.

How to fix

1 Add a server-level 301 redirect from HTTP to the HTTPS equivalent URL.
2 Verify the redirect preserves the full path and query string.

Fix it in your stack

Nginx

A server block on port 80 that only redirects.

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Apache

In .htaccess or the port 80 virtual host, with mod_rewrite enabled.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Cloudflare

SSL/TLS, then Edge Certificates: turn on Always Use HTTPS.

AWS load balancer

Give the HTTP:80 listener a default action that redirects to HTTPS:443 with status HTTP_301.

Node.js (Express)

Behind a proxy or load balancer that ends TLS, trust its forwarded protocol first.

app.set('trust proxy', 1);
app.use((req, res, next) =>
  req.secure ? next() : res.redirect(301, `https://${req.headers.host}${req.originalUrl}`));

Common mistakes

Redirecting the homepage but not every path, so deep links to specific pages still load over HTTP.
Using a temporary (302) redirect instead of a permanent (301) one, which does not properly consolidate SEO signal onto the HTTPS URL.
Losing the original path or query string in the redirect, sending users to the HTTPS homepage instead of the specific page they requested.

How to verify

1 Request several different HTTP URLs (not just the homepage) and confirm each returns a 301 redirect to the matching HTTPS URL.
2 Confirm the redirect preserves the full path and query string rather than dropping them.
3 Check that the redirect happens at the server/CDN level (fast, before any application code runs) rather than via a slower client-side redirect.

Questions

Should the redirect be a 301 or a 302?: A permanent one: 301, or 308 when the request method must be kept. Browsers cache it, and search engines move the ranking of the http:// URL to the https:// one. A 302 tells them the move is temporary.
Is a redirect enough on its own?: No. The first request still goes out over plain HTTP, where it can be intercepted before the redirect arrives. Add an HSTS header so returning browsers go straight to HTTPS.
What does EngineeringScore check?: It requests the http:// address of the page and looks for a redirect to https://. When it cannot observe the answer, the check is reported as not determined instead of passed.
What can break after switching?: Scripts, images and styles still linked with http:// become mixed content on the HTTPS page, and browsers block or warn about them. Update those links in the same change.

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site