EngineeringScoreBest Practices Small
Redirect HTTP to HTTPS
Even after HTTPS is available, visitors and search engines who land on the plain-HTTP URL (from an old link, a bookmark, or a direct type-in) will stay there unless the server actively redirects them. Without that redirect, the insecure version keeps getting used indefinitely, and SEO authority can end up split between the HTTP and HTTPS versions of the same content.
Why it matters
If HTTP requests aren't redirected, visitors and search engines who land on the insecure URL stay on it, exposing them to interception and splitting SEO signal between the HTTP and HTTPS versions.
How to fix
- 1 Add a server-level 301 redirect from HTTP to the HTTPS equivalent URL.
- 2 Verify the redirect preserves the full path and query string.
Common mistakes
- Redirecting the homepage but not every path, so deep links to specific pages still load over HTTP.
- Using a temporary (302) redirect instead of a permanent (301) one, which does not properly consolidate SEO signal onto the HTTPS URL.
- Losing the original path or query string in the redirect, sending users to the HTTPS homepage instead of the specific page they requested.
How to verify
- 1 Request several different HTTP URLs (not just the homepage) and confirm each returns a 301 redirect to the matching HTTPS URL.
- 2 Confirm the redirect preserves the full path and query string rather than dropping them.
- 3 Check that the redirect happens at the server/CDN level (fast, before any application code runs) rather than via a slower client-side redirect.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.