Seen From Outside Free report

1 of 7 things we check

HTTPS & redirects

Does everyone land on the padlocked https:// version of your site?

Your website, drawn as a building. This page is about number 1, HTTPS.

What we look at

  • There's an https:// version. Your site answers on https://. If only plain http:// answers, that's a High problem.
  • Everyone ends up on https://. Typing your address without https:// takes people straight to the padlocked version. If plain http:// shows the site instead, that's a Medium problem.
  • No step backwards. Once someone is on https://, nothing sends them back to plain http://.
  • Short, tidy redirects. Getting to your home page takes two hops or fewer. Three to five hops, or a hop to another website, earns a Note. A loop, or more than five hops, is a Low problem.
  • Nothing loaded the old way. Your home page doesn't pull in scripts, stylesheets or frames over plain http://. Images over plain http:// only earn a Note.

Why it matters

HTTPS keeps what passes between your visitors and your site private, and the padlock shows them the connection is protected.

Without it, anything typed into your site, like a contact form, can be read or changed on the way. Most browsers also tell visitors when a page isn't using it.

The fixes are usually small, and the report says who can make them.

In our sample report

Here's this part of our sample report for a demo website. example.com is a demonstration domain: we made up what it shows, then ran it through our real checks and report.

Sample report · example.com · illustrative data

HTTPS & redirects

80 out of 100. 5 of 5 checks completed

4 passed · 1 issue

  • Passed HTTPS availability

    example.com serves HTTPS

  • Medium HTTP to HTTPS redirect

    www.example.com does not redirect HTTP to HTTPS

    For you

    Visitors who type the address without https:// stay on an unencrypted connection, where their traffic can be read or changed.

    What to do: Redirect every plain-HTTP request to the same address over HTTPS.

    For your IT provider

    nginx

    server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

    Apache

    RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    Cloudflare

    SSL/TLS → Edge Certificates → Always Use HTTPS: On.

  • Passed No HTTPS to HTTP downgrade

    example.com never redirects from HTTPS to HTTP

  • Passed Redirect behaviour

    example.com redirects cleanly

  • Passed Mixed content

    https://example.com/ loads everything over HTTPS

Who fixes it

In your report, anything to fix in this area goes to:

  • Your web host or website developer.

What we can't see from outside

We only look at your home page, at your domain and its www address. Other pages and other subdomains aren't checked, and we never follow the links in your page.