The page is served over plain HTTP

Audit check https · worth 10 of 100 points · all checks

What the audit saw

The URL answers on http:// and does not upgrade to https://.

Why it costs you

Browsers label http pages 'Not secure', and the label sits right next to the address bar. It costs conversions on any page that asks for anything, and it is a ranking signal.

How to find it on your site

  1. Force the upgrade in nginx 
    server {
    listen 80;
    server_name your-site.com www.your-site.com;
    return 301 https://your-site.com$request_uri;
}
  2. Force it in Caddy, which does this by default 
    your-site.com {
    redir https://{host}{uri} permanent
}
  3. GitHub Pages or Netlify: tick 'Enforce HTTPS' 
    # Settings -> Pages -> Enforce HTTPS
# Netlify: Domain management -> HTTPS -> Force HTTPS

How to know it is fixed

curl -sSI http://your-site.com/ | head -1   # expect 301, then Location: https://...

The part people get wrong

If the certificate was issued after the redirect was added, the redirect can loop. Check with curl -sSIL and count the hops; more than two means the loop.

Check it against your own site

Open an issue with your URL and a bot runs this check plus 14 others, posts the failures with the measured values, and publishes a report page: free audit. If you want the fixes applied and re-verified instead: fixed-price tiers.

Other checks

The site does not answer on the URL you gave · The TLS certificate is expired or about to exp · No mobile viewport tag · The page title is missing or the wrong length · The meta description is missing or the wrong l · The page has no H1, or more than one · Images have no alt text · Responses are not compressed

All published audits · Check reference