Skip to main content
Security Auditor: checks that visitors who reach your site over plain http:// are sent to the HTTPS address with a permanent redirect.

Encryption

Makes sure old links, bookmarks and typed addresses end up on an encrypted connection.

Search

A permanent redirect tells search engines to rank the HTTPS address instead of the insecure one.
Many visitors never type https://: they follow old links, use bookmarks saved years ago, or type only example.com. Those requests reach your server over plain HTTP, where anyone on the same network can read or change them. The server should answer every one of them with a permanent redirect to the same address on HTTPS. This auditor requests the http:// form of the audited URL and checks what comes back.

​
How it works

  1. HTTP address: the audited URL is turned into its http:// form (https://example.com/shop becomes http://example.com/shop; a URL without a scheme gets http://).
  2. Fetch: sends a HEAD request (or GET when HEAD is answered with 405) to that address as 37AuditsBot, without following redirects. A blocked request ends the audit with 590. A refused connection (nothing listens on the HTTP port) warns with 301. A timeout, DNS failure or HTTP 5xx ends the audit with 500.
  3. Location: the Location header is resolved against the HTTP address, so a relative Location: /shop points at http://example.com/shop.
  4. Rules: an answer that is not a redirect (400), a redirect without Location (401) and a redirect to an address that is not HTTPS (402) fail. A temporary redirect to HTTPS (302, 303 or 307) warns (300).
  5. Aggregate: FAIL wins over WARNING. A permanent redirect (301 or 308) to an HTTPS address is SUCCESS (200).

​
What it audits

Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 200 success, 300–399 warning, 400–499 fail, 500–599 error.

​
Output documentation

​
Risks and considerations

​
Why plain HTTP still matters

  • Browsers increasingly try HTTPS first, but old links, bookmarks, emails, QR codes and some clients still use http://. Without a redirect, those visitors see the site unencrypted, and anyone on the same Wi-Fi can read or change what they see and send.

​
Permanent or temporary

  • 301 and 308 are permanent: browsers cache them, so later visits skip the insecure request, and search engines move ranking signals to the HTTPS address. 308 also keeps the request method (a POST stays a POST).
  • 302, 303 and 307 are temporary: the browser asks over plain HTTP on every visit, which leaves a window for an attacker to answer first.

​
A closed HTTP port

  • A server that refuses connections on port 80 serves nothing insecure, but anyone who reaches the plain address gets a connection error instead of your site. Answering on port 80 with a redirect is friendlier and just as safe.
  • A connection that times out is reported as ERROR: from the outside it cannot be told apart from a network problem between 37AuditsBot and your server.

​
What this auditor does not check

  • Only the first answer is read. The auditor does not follow the redirect, so it does not check that the HTTPS address loads, nor how many hops the chain has.
  • A redirect to a different host (http://example.com to https://www.example.com) passes. HSTS preloading needs the first hop to stay on the same host; see the HSTS Preload auditor.