Finding: No HTTPS Redirect
HTTP requests to this domain are not redirected to HTTPS at all — visitors who type the address without https:// (almost everyone) stay on the unencrypted version of the site for the whole visit.
Last updated August 11, 2026.
What it means
A browser that isn't told otherwise requests http:// first, by default. A correctly configured site immediately redirects that request to https://. This finding fires when a plain HTTP request to the domain gets an ordinary (non-redirect) response instead — the site simply serves content over HTTP with no attempt to move the visitor to the encrypted version.
Why it matters
Even if an HTTPS version of the site exists and works fine when visited directly, most real visitors never type https:// by hand — they type the bare domain, click an old link, or follow a bookmark, and the browser fills in http://. Without a server-side redirect, those visitors stay on the unencrypted connection for the entire session. Anything they submit — login credentials, form data, cookies — is readable in transit by anyone positioned between them and the server, for example on a shared or unsecured network.
What Nivaronix checks
Nivaronix makes a live HTTP request to the domain and checks the response status code and Location header. If the response is not a redirect (301/302/303/307/308) at all, this finding fires. This is a configuration check against the live response — not a vulnerability scan.
Example evidence (illustrative — not live scan data)
GET http://example.com/ HTTP/1.1 HTTP/1.1 200 OK (page served directly over HTTP, no redirect)
How to fix it
Configure the web server or load balancer to issue a 301 redirect from every http:// request to the equivalent https:// URL.
Nginx
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Apache
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Cloudflare
Turn on "Always Use HTTPS" under SSL/TLS → Edge Certificates. This makes Cloudflare issue the redirect at the edge even if the origin server has no redirect rule configured of its own.
How to verify the fix
Re-run the website security scanner and confirm a plain HTTP request to your domain now returns a 301 redirect to https://. Once redirects are in place, consider adding HSTS so browsers skip the insecure request on future visits entirely.