Fix this week

The plain, unlocked version of your site still works

What it means

Your site can be reached two ways: https://example.com, which is encrypted and shows a padlock, and http://example.com, which is not. People still land on the http version by typing your address without the prefix, clicking an old link, or scanning a printed QR code.

A redirect sends anyone who arrives on http straight to the https version. EverThread requested the http address and did not get sent to https. Instead it got a normal page, an error, or a redirect to another http address.

If your site does not have a working https version at all, set that up first. The redirect only helps when there is somewhere secure to send people.

Why it matters

Visitors on the http version see "Not secure" next to your address. Anything they type into a contact form, login or checkout can be read or changed by someone on the same network, such as public Wi-Fi.

It also splits your site in two for search engines, which can treat the http and https addresses as separate copies of the same pages. A permanent redirect tells them which one is real.

The redirect is also the first step toward Strict-Transport-Security, a setting that tells browsers to skip the http version entirely on future visits.

How to check your own site

1. Type your address into a browser starting with http://, for example http://example.com. After the page loads, look at the address bar. If it still says http or "Not secure", there is no redirect.
2. Try the www and non-www versions too. Each one needs to redirect.
3. Try a deeper page, such as http://example.com/contact. It should land on the same page over https, not on your home page.
4. Some browsers now try https on their own, which can hide the problem. If you are not sure, your developer can run curl -I http://example.com and look for a 301 status and a Location: line starting with https://.

How to fix it

Any website

1. Look in your hosting dashboard for a setting called "Force HTTPS", "HTTPS redirect" or similar. Many hosts have one, usually under SSL, Security or Domains.
2. Turn it on, then test with the steps above.
3. If there is no such setting, ask your host or developer: "Please add a permanent 301 redirect from http to https for all pages on example.com and www.example.com."

WordPress

1. Under Settings, General, make sure both "WordPress Address" and "Site Address" start with https://. This tells WordPress which address to use in links, but on its own it does not redirect every http request on every host.
2. Then add the redirect at the host level. Use your host's force HTTPS setting, or add the Apache rule from the section below to the top of your .htaccess file, above the # BEGIN WordPress line. Back up the file first.
3. If your site runs through Cloudflare, use the Cloudflare setting instead of an .htaccess rule, to avoid a redirect loop.

Shopify, Squarespace, Wix and other hosted builders

1. Shopify and Wix serve every site over https and handle the redirect for you. If EverThread flags this on one of them, check that your domain is fully connected in the platform's domain settings.
2. Squarespace has a setting for this, usually under Settings in a section named Security and SSL. Choose the secure option and turn on HSTS if it is offered.
3. Other builders generally handle the redirect once your domain is connected. If yours does not, ask its support.

cPanel hosting

1. Open "Domains". Each domain has a "Force HTTPS Redirect" switch. Turn it on for every domain your site uses.
2. The switch may be unavailable until the domain has a valid certificate. If so, open "SSL/TLS Status", click "Run AutoSSL", then come back.

Cloudflare

1. Under SSL/TLS, Edge Certificates, turn on "Always Use HTTPS". Cloudflare then redirects every http request before it reaches your server.
2. If your SSL/TLS encryption mode is "Flexible", do not also add a redirect on your server. In that mode Cloudflare talks to your server over http, so a server redirect sends every request around in a loop ("too many redirects"). Better still, install a certificate on the server and switch to "Full (strict)".

Apache or Nginx

1. Add a rule that answers every http request with a 301 redirect to the same path on https.
2. On Nginx, give port 80 its own server block that does nothing but redirect.
3. On Apache, add the rewrite rule to the site configuration or .htaccess. The mod_rewrite module must be enabled.
4. If you use Certbot, its Apache and Nginx plugins can add this redirect for you when they install the certificate.
5. Test the configuration, reload the server, and check a few addresses with curl.

# Nginx: a dedicated port 80 server block
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

# Apache: site configuration or .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

What to send your developer

EverThread sends a HEAD request to http:// your host and expects a 3xx response whose Location starts with https://. A 200, an error status, no answer, or a first hop to another http address all count as missing. Redirect to https in a single hop, keep the path and query string, and answer HEAD the same way as GET. Use 301 or 308 so search engines treat the move as permanent. Behind a load balancer or proxy that terminates TLS, %{HTTPS} is always off at the origin, so redirect at the proxy or check X-Forwarded-Proto instead. Once every hostname redirects, add a Strict-Transport-Security header.

curl -sI http://example.com/some/page?x=1 | grep -iE "^(HTTP|location)"

Common questions