HTTP redirects to HTTPS

Scan.now sends GET http://<host>/ on port 80 and follows up to five redirects, recording each status code and Location header. The check passes when the chain ends at an https:// URL on the same host, using a permanent status (301 or 308). It fails when port 80 answers 200 with page content, when the redirect points to another plain-HTTP URL, or when the chain never reaches HTTPS. Two softer conditions are reported as notes rather than failures: a temporary redirect (302 or 307), which browsers do not cache, and a first hop that goes to HTTPS on a different host (for example http://example.com straight to https://www.example.com), which is valid but disqualifies the domain from HSTS preloading. If nothing listens on port 80 at all, the check records that as informational: no downgrade surface, but users typing the bare name in older browsers will get a connection error.

The first request a browser makes when someone types example.com is still plain HTTP unless the domain is preloaded or the browser has seen an HSTS header before. That single request is the foothold for SSL stripping: an attacker on the path answers it themselves, serves a rewritten copy of your site over HTTP, and proxies the real HTTPS site behind the scenes, harvesting logins and cookies as they pass. If port 80 serves full content, the whole site is usable without encryption and nothing forces a user onto the secure version. Cookies lacking the Secure flag are sent on that first request. The HSTS guide covers the attack and the layered defence in detail.

Redirect every HTTP request permanently to the same path on HTTPS, then add an HSTS header on the HTTPS side so returning browsers skip HTTP entirely. nginx:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Apache (mod_rewrite is not needed for a whole-host redirect):

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

Express behind a reverse proxy that sets X-Forwarded-Proto:

app.set('trust proxy', 1);
app.use((req, res, next) => {
  if (req.secure) return next();
  res.redirect(301, 'https://' + req.headers.host + req.originalUrl);
});

On Cloudflare, enable Always Use HTTPS under SSL/TLS > Edge Certificates; the edge answers port 80 with a 301 before the request reaches your origin. Keep the redirect on the same hostname (apex to apex, www to www) and do the canonical www/non-www redirect as a second hop over HTTPS, which is what the preload list requires.