How to force HTTPS for all traffic?

https-not-enforcedglobal

Forcing HTTPS requires two mechanisms: redirecting existing HTTP requests to HTTPS and preventing future HTTP connections. HTTP to HTTPS redirects at the server level catch initial HTTP requests and upgrade them. HTTP Strict Transport Security headers instruct browsers to use only HTTPS for subsequent visits. Together, these mechanisms eliminate HTTP traffic entirely. Partial enforcement leaves HTTP pathways active.

What’s wrong

The site accepts HTTP connections or lacks mechanisms to redirect all HTTP traffic to HTTPS. HTTP requests either succeed, loading insecure content, or fail without redirecting. No Strict-Transport-Security header exists to prevent future HTTP attempts. Users accessing the site over HTTP remain on HTTP. Direct HTTP links continue working. The site maintains two protocol entry points instead of forcing one secure channel.

Why it matters

HTTP traffic is unencrypted and unauthenticated. Network observers see all transmitted data including credentials, tokens, and sensitive information. Attackers can intercept and modify HTTP responses without detection. The first request to a site typically uses HTTP before redirecting to HTTPS, creating a window for interception. Without HSTS, browsers continue attempting HTTP connections on subsequent visits. This initial HTTP request remains vulnerable to downgrade attacks where attackers prevent the HTTPS upgrade.

The correct change

Configure the server to redirect all HTTP requests to their HTTPS equivalents with 301 or 302 status codes. The redirect must preserve the path and query string while changing only the protocol. Add the Strict-Transport-Security header to all HTTPS responses with a long max-age value. Set max-age to at least 31536000 seconds for one year. Include includeSubDomains if all subdomains support HTTPS. The end state is a site that redirects HTTP requests immediately and instructs browsers to use only HTTPS for future connections.

Scope

This condition applies globally. The entire site must enforce HTTPS, not individual pages. HTTP to HTTPS redirection happens at the server or load balancer level before application code executes. HSTS headers apply per hostname. Subdomains require separate HSTS headers unless the parent domain uses includeSubDomains. Mixed enforcement where some paths allow HTTP creates security gaps.

How to verify

• Validation confirms the condition is resolved:
• • HTTP requests to any path redirect to HTTPS equivalents
• • Strict-Transport-Security header present on all HTTPS responses
• • HSTS max-age is at least 31536000 seconds
• • Browser internal HSTS list includes the domain after first visit
• • Typing HTTP URLs in browser automatically upgrades to HTTPS
• • No HTTP responses succeed without redirecting
• • All subdomains redirect HTTP if includeSubDomains is used

Takeaway

• Forcing HTTPS requires both redirects and HSTS headers
• Redirects upgrade initial HTTP requests to HTTPS
• HSTS prevents browsers from making future HTTP requests
• The first request remains vulnerable without HSTS preload
• All subdomains must support HTTPS before using includeSubDomains

FAQ

Should redirects use 301 or 302 status codes?

301 Moved Permanently signals the redirect is permanent. Browsers and search engines cache permanent redirects. 302 Found indicates a temporary redirect that should not be cached. Use 301 for HTTP to HTTPS redirects because the change is permanent. The status code difference matters for search engine handling and client caching behavior.

Does HSTS prevent the first HTTP request?

Not without preload. The first visit to a site must complete before browsers learn about HSTS. This first request is vulnerable to interception and downgrade attacks. HSTS preload solves this by including domains in a browser-embedded list. Sites on the preload list start with HTTPS enforcement even on first visit. Preload requires specific HSTS configuration and submission to the preload list.

What breaks when forcing HTTPS if the certificate is invalid?

Browsers block access with certificate warnings. Users cannot easily bypass these warnings in modern browsers. The site becomes inaccessible until certificate issues resolve. Ensure certificates are valid, not expired, and cover all hostnames before forcing HTTPS. Test HTTPS thoroughly before adding HSTS headers with long max-age values.

Should APIs and subdomains also force HTTPS?

Yes. All hostnames including APIs, admin panels, and subdomains should force HTTPS. API credentials and data require the same protection as web pages. Use includeSubDomains in HSTS headers carefully because it applies the policy to all subdomains. Verify every subdomain supports HTTPS before enabling includeSubDomains or they become inaccessible.

How does HSTS affect development and staging environments?

HSTS applies to hostnames, not environments. Using production hostnames in development with HSTS causes browsers to require HTTPS in development too. Use different hostnames for development and staging that are not in the HSTS preload list. Alternatively, ensure development environments support HTTPS with valid certificates. Clearing browser HSTS state requires manual browser intervention and is not user-friendly.

Can load balancers handle HTTP to HTTPS redirects?

Yes. Most load balancers and reverse proxies support HTTP to HTTPS redirects without reaching application servers. Configure redirects at the infrastructure level for better performance. Application servers still need HSTS headers on HTTPS responses. Redirecting at the load balancer prevents HTTP requests from traversing internal networks unnecessarily.

The fix

Eliminate HTTP as a viable protocol by redirecting requests and enforcing HTTPS in browsers

Done when: All HTTP requests redirect to HTTPS and HSTS prevents future HTTP connection attempts

Do not

• Do not enable HSTS before verifying all content and subdomains work over HTTPS
• Do not use short HSTS max-age values that expire too quickly
• Do not redirect only specific paths while leaving others accessible over HTTP
• Do not apply includeSubDomains without confirming every subdomain supports HTTPS

How to verify

• HTTP requests redirect to HTTPS with 301 status codes
• Strict-Transport-Security header present with long max-age
• Browser HSTS state shows domain as HTTPS-only
• No HTTP requests succeed without redirecting
• All paths and subdomains work correctly over HTTPS

Find every page with this

probeo monitors this continuously across every page of your site, and records which pages passed, which failed, and which it could not determine.