Start Monitoring Free
✦ Free SEO tool

HTTPS Redirect Checker

Test whether the insecure http:// version of a page redirects to https:// in one permanent hop, and whether HTTPS is set up properly behind it.

Fetching and analysing the page…

5 of 5 free checks left today. Create a free account for unlimited checks.

HTTPS Redirect Checker - results and guide

What the HTTPS Redirect Checker checks

  • Whether http:// redirects to https:// at all
  • Whether the first redirect is permanent (301 or 308) and goes straight to https
  • Whether the https version loads with a valid certificate
  • The Strict-Transport-Security (HSTS) header and its max-age
  • Mixed content: scripts, styles, frames and images still loaded over http
  • Forms that submit to an http address
  • The full chain of the http:// request

Why redirect HTTP to HTTPS?

HTTPS encrypts the connection between the visitor and the site. Browsers mark plain http pages as "Not secure", Google uses HTTPS as a ranking signal, and several browser features only work on secure pages. Installing a certificate is half of the job. The other half is making sure nobody stays on the insecure version.

If both http:// and https:// answer with a page, you have two copies of the site. Visitors who follow an old link remain unencrypted, and search engines must choose between duplicates. A site-wide permanent redirect solves both.

What a correct setup looks like

Every http URL should answer with a single 301 to the same path on https. The secure response should then send Strict-Transport-Security: max-age=31536000; includeSubDomains. With HSTS the browser remembers to use https for the next year and never asks for the insecure address again, which closes the brief window in which a first request could be intercepted.

The page itself must load everything over https. A script or stylesheet requested over http is blocked by the browser, so parts of the page silently stop working. To check that all four combinations of protocol and www agree, use the WWW Redirect Checker. To be warned before a certificate expires, see SSL monitoring.

How to use the HTTPS Redirect Checker

  1. Enter the address of the page you want to check. You can leave out https://.
  2. Press Check HTTPS. The page is fetched from our servers, the way a search engine crawler would fetch it.
  3. Read the findings from top to bottom: problems first, then warnings. Each one says what to change.

Common problems and how to fix them

http:// does not redirect

Add a rule to the web server. Apache: RewriteCond %{HTTPS} off, then RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]. Nginx: return 301 https://$host$request_uri; in the port 80 server block. Most CDNs have an "Always use HTTPS" switch.

The redirect is a 302

Change the rule to return 301 so the secure URL is treated as the permanent address.

Mixed content warnings

Update hard-coded http:// addresses in templates and content to https://, or use relative URLs. A Content-Security-Policy of upgrade-insecure-requests is a useful stopgap.

Frequently asked questions

Is HTTPS a ranking factor?
Yes. Google confirmed HTTPS as a lightweight ranking signal in 2014. Browsers also warn visitors on pages without it.
What is HSTS?
HTTP Strict Transport Security is a response header that tells browsers to use https for every future visit to the site, without trying http first.
Should the redirect be 301 or 302?
301. The move to HTTPS is permanent, and a 301 tells search engines to index the secure URL.
What is mixed content?
A secure page that loads some resources over insecure http. Browsers block insecure scripts and styles and may block or upgrade images.

See all 27 free SEO tools →

Monitor Today. Stay Ahead.

SEO gets visitors to your site. Uptime keeps them there.

Monitor 5 websites free forever and get alerted the moment one goes down. No credit card required.

Start Monitoring Free Run a free AI check