HTTP not redirecting to HTTPS: send every visitor to the HTTPS address

Why it matters

Visitors who type your domain, or click an old http:// link, land on the plain HTTP version. Browsers mark such pages with a Not secure label in the address bar, and anything sent on that page travels unencrypted. A redirect fixes the first visit; the HSTS header makes the browser use HTTPS on later visits without asking. MDN notes that browsers ignore HSTS sent over HTTP, so you need both.

Turn the redirect on

Cloudflare (proxied domains): Cloudflare's docs: Always Use HTTPS "redirects all your visitor requests from http to https" for all subdomains and hosts. Go to SSL/TLS > Overview, make sure the encryption mode isn't Off, then Edge Certificates and switch on Always Use HTTPS. Cloudflare advises against also "performing redirects at your origin web server", which can cause redirect loops.

Vercel: Vercel redirects HTTP to HTTPS itself; its guide notes that "Vercel's automatic HTTP-to-HTTPS redirect can't be disabled". If http:// still loads, something in front of Vercel (a proxy) is answering instead.

Netlify, Firebase Hosting, app builders: check the domain's status in the host's dashboard. Netlify says that when you add a custom domain it will "automatically provision a certificate with Let's Encrypt"; check the certificate's status in the domain's HTTPS settings, since HTTPS can't work until one is active.

Your own server (Nginx example):

server {
  listen 80;
  server_name yourdomain.com www.yourdomain.com;
  return 301 https://$host$request_uri;
}

Test this on a preview deployment before relying on it.

If the redirect loops

ERR_TOO_MANY_REDIRECTS usually means two layers are redirecting against each other, typically Cloudflare in front of another host. Vercel's guide: "Cloudflare's Flexible SSL/TLS mode is one possible cause", because Cloudflare reaches the host over HTTP and the host redirects it back to HTTPS. The fix it gives is Cloudflare's Full (strict) mode, with a valid certificate on the host.

Confirm it

Run curl -sI http://yourdomain.com. The first line should be a 301, 302, 307 or 308 status, with a location: header that starts with https://.

What Pewterkit Check looks at

The check requests http:// plus your host name without following redirects. It's OK when the answer is a redirect to an https:// address, and a fix when plain HTTP answers without moving visitors to HTTPS. If plain HTTP doesn't answer at all, it reports that as information, since there's nothing to redirect.