"No redirect to HTTPS" means a visitor who types http://yourbusiness.com stays on the unencrypted version of your site. Fix it by confirming your site loads at https:// first, then turning on your host's Force HTTPS setting, or Always Use HTTPS in Cloudflare. If you run your own server, add a 301 redirect from port 80 to HTTPS.
If your CyberVigil report says "No redirect to HTTPS," your site already has a working certificate. The gap is the front door: someone who types your address without https:// lands on the unencrypted version and stays there.
Most hosts fix this with a single switch. Scan your site below to see where your plain HTTP requests end up today.
- Free check
- No signup
- No changes to your website
What does "no redirect to HTTPS" mean?
Your website can answer at two addresses: http://yourbusiness.com and https://yourbusiness.com. Only the HTTPS version is encrypted. A redirect sends everyone who asks for the HTTP version over to HTTPS automatically.
Our scan requests your homepage over plain HTTP and follows up to five redirects. If the last page in that chain still starts with http://, we report it as "Needs attention." If your server doesn't answer on plain HTTP at all, that counts as a pass, because there's no unencrypted copy to land on.
Why does the redirect matter?
Browsers now try HTTPS first in many cases, but not always. Old links, printed flyers, email signatures and bookmarks often still point to http://. Without a redirect, those visitors see a "Not secure" label, and anything they type into a contact or booking form travels unencrypted.
It also splits your site in two. Search engines can find both versions, and visitors can share either one. A permanent redirect gives you one address for every page.
How do I check that HTTPS works first?
Forcing HTTPS on a site with a broken certificate locks everyone out, so check this before you change anything.
- Open a private browser window and go to
https://yourbusiness.com. - Confirm the page loads with a padlock and no warning.
- Click through a few pages, including your contact form, and look for missing images or styling. Those are usually "mixed content" links that still use
http://.
If HTTPS doesn't load, fix that first with our guide to why a website says "Not secure". The free SSL checker shows whether your certificate is valid.
See every website and email setting at once
Run a free scan for a plain-English report on HTTPS, certificates, security headers and your email protection.
- Free check
- No signup
- No changes to your website
How do I turn on the HTTPS redirect?
Use the setting at whatever sits in front of your site. If you use Cloudflare, set it there and not also at your host, since Cloudflare says redirects at the origin server can cause redirect loops.
Instructions for Cloudflare
- 1In the Cloudflare dashboard, open SSL/TLS → Overview and make sure the encryption mode isn't Off. Cloudflare hides Always Use HTTPS when it is.
- 2Choose Full (strict) if your host has a valid certificate, or Full if it has a self-signed one. Avoid Flexible if your host also redirects to HTTPS.
- 3Open SSL/TLS → Edge Certificates and turn on Always Use HTTPS.
How do I check that it worked?
- Open a private window and type
http://yourbusiness.com. The address bar should switch tohttps://and show the padlock. - Try
http://www.yourbusiness.comtoo, since the two names are often set up separately. - Re-run your scan. The HTTPS redirect result should now show "Redirect is in place."
If you're comfortable in a terminal, curl -I http://yourbusiness.com should return a 301 with a Location header that starts with https://.
What should you do next?
- Update your sitemap, internal links and email signature to use
https://addresses. - Once the redirect has run cleanly for a week or two, add HSTS so browsers skip the HTTP step entirely. Our guide to turning on HSTS walks through it in stages.
- Re-run the free website security scan to see what else is worth fixing.
Common questions
Is a missing HTTPS redirect serious?
It's worth fixing soon, though it isn't an emergency. Your site still has HTTPS, but people who arrive from an old link or type the address without https:// browse an unencrypted copy. Anything they type into a form on that copy can be read on public Wi-Fi.
Should I use a 301 or a 302 redirect?
Use a 301, which tells browsers and search engines the move is permanent. Google's site move guide recommends permanent server-side redirects when URLs change, and HTTP to HTTPS is a permanent change.
Why does my site say "too many redirects" after I turned this on?
Two settings are redirecting against each other. The most common cause is Cloudflare's Flexible SSL mode combined with a redirect at your host. Cloudflare sends your host plain HTTP requests, your host redirects them to HTTPS, and the loop repeats. Set Cloudflare to Full or Full (strict), or remove the redirect at your host.
Will redirecting to HTTPS hurt my search rankings?
No. A permanent redirect passes visitors and search engines to the same page at its HTTPS address. Update your sitemap and internal links to use https:// so search engines don't keep requesting the old addresses.
Do I still need this if I use HSTS?
Yes. HSTS only works after a browser has visited your site over HTTPS once and received the header. The redirect handles the first visit, and HSTS handles the visits after it.
Sources
- Always Use HTTPS (Cloudflare Docs)
- ERR_TOO_MANY_REDIRECTS (Cloudflare Docs)
- Redirecting and Remapping with mod_rewrite (Apache HTTP Server Documentation)
- Module ngx_http_rewrite_module (nginx.org)
- Site moves with URL changes (Google Search Central)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.