> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.
# HTTP Redirect Auditor
> Checks that the plain http:// address of your site redirects permanently to HTTPS
**Security Auditor**: checks that visitors who reach your site over plain `http://` are sent to the HTTPS address with a permanent redirect.
Makes sure old links, bookmarks and typed addresses end up on an encrypted connection.
A permanent redirect tells search engines to rank the HTTPS address instead of the insecure one.
Many visitors never type `https://`: they follow old links, use bookmarks saved years ago, or type only `example.com`. Those requests reach your server over plain HTTP, where anyone on the same network can read or change them. The server should answer every one of them with a permanent redirect to the same address on HTTPS. This auditor requests the `http://` form of the audited URL and checks what comes back.
## How it works
1. **HTTP address**: the audited URL is turned into its `http://` form (`https://example.com/shop` becomes `http://example.com/shop`; a URL without a scheme gets `http://`).
2. **Fetch**: sends a `HEAD` request (or `GET` when `HEAD` is answered with `405`) to that address as 37AuditsBot, **without following redirects**. A blocked request ends the audit with `590`. A refused connection (nothing listens on the HTTP port) warns with `301`. A timeout, DNS failure or HTTP 5xx ends the audit with `500`.
3. **Location**: the `Location` header is resolved against the HTTP address, so a relative `Location: /shop` points at `http://example.com/shop`.
4. **Rules**: an answer that is not a redirect (`400`), a redirect without `Location` (`401`) and a redirect to an address that is not HTTPS (`402`) fail. A temporary redirect to HTTPS (`302`, `303` or `307`) warns (`300`).
5. **Aggregate**: `FAIL` wins over `WARNING`. A permanent redirect (`301` or `308`) to an HTTPS address is `SUCCESS` (`200`).
## What it audits
Every row maps to one `checkRule*` method and one `CheckCode`, in the order the auditor runs them. CheckCode suffixes use status ranges: `200` success, `300–399` warning, `400–499` fail, `500–599` error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
| - | - | - | - | - |
| `37A-HttpRedirectAuditor-400` | `FAIL` | The HTTP address answers with a status that is not a redirect (`200`, `404`, …). | Make `{httpUrl}` answer with a 301 redirect to `{httpsUrl}`. | Visitors and links that use http\:// get the site over an unencrypted connection, where anyone on the same network can read or change the pages, forms and cookies. |
| `37A-HttpRedirectAuditor-401` | `FAIL` | The HTTP address answers with a redirect status but no `Location` header. | Add "Location: `{httpsUrl}`" to the HTTP `{status}` response of `{httpUrl}`, or switch it to a 301 redirect to that address. | A redirect without a destination leaves browsers on an error page, so visitors who type the plain address never reach the site. |
| `37A-HttpRedirectAuditor-402` | `FAIL` | The redirect `Location`, resolved against the HTTP address, is not an `https://` address. | Change the Location of `{httpUrl}` from "`{location}`" to `{httpsUrl}` and use a 301 redirect. | Visitors stay on an unencrypted connection after the redirect, so passwords, forms and cookies can be read or altered by anyone on the same network. |
| `37A-HttpRedirectAuditor-300` | `WARNING` | The HTTP address redirects to HTTPS with a temporary status: `302`, `303` or `307`. | Change the HTTP `{status}` redirect of `{httpUrl}` to `{target}` into a permanent one: 301, or 308 to keep the request method. | Browsers and search engines do not remember a temporary redirect, so every visit starts with an unencrypted request and search rankings may stay attached to the insecure address. |
| `37A-HttpRedirectAuditor-200` | `SUCCESS` | All rules passed. Message is `{httpUrl} redirects permanently (HTTP {status}) to {target}.` | — | — |
| `37A-HttpRedirectAuditor-301` | `WARNING` | The server refuses connections on the HTTP port (nothing listens on it). | Open port `{port}` on `{host}` and answer `{httpUrl}` with a 301 redirect to `{httpsUrl}`. | Nothing is served without encryption, but visitors who follow an old http\:// link or type the address in a browser that does not upgrade to HTTPS get a connection error instead of the site. |
| `37A-HttpRedirectAuditor-500` | `ERROR` | The HTTP address could not be checked: timeout, DNS failure or HTTP 5xx. | Make sure `{httpUrl}` answers within 20 seconds, then run the audit again. Last error: `{error}`. | — |
| `37A-HttpRedirectAuditor-590` | `ERROR` | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See [https://www.37audits.com/bot](https://www.37audits.com/bot). | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |
## Output documentation
| Status | Description | Test logic |
| - | - | - |
| **SUCCESS** | The HTTP address redirects permanently to HTTPS | `301` or `308` with a `Location` that resolves to `https://` (`200`). |
| **WARNING** | The redirect is temporary, or the HTTP port is closed | `302`, `303` or `307` to HTTPS (`300`); connection refused (`301`). |
| **FAIL** | Visitors can stay on plain HTTP | No redirect (`400`); redirect without `Location` (`401`); redirect to a non-HTTPS address (`402`). |
| **ERROR** | The auditor could not check the HTTP address | Timeout, DNS failure or HTTP 5xx (`500`); site blocked 37AuditsBot (`590`). |
## Risks and considerations
### Why plain HTTP still matters
* Browsers increasingly try HTTPS first, but old links, bookmarks, emails, QR codes and some clients still use `http://`. Without a redirect, those visitors see the site unencrypted, and anyone on the same Wi-Fi can read or change what they see and send.
### Permanent or temporary
* `301` and `308` are permanent: browsers cache them, so later visits skip the insecure request, and search engines move ranking signals to the HTTPS address. `308` also keeps the request method (a `POST` stays a `POST`).
* `302`, `303` and `307` are temporary: the browser asks over plain HTTP on every visit, which leaves a window for an attacker to answer first.
### A closed HTTP port
* A server that refuses connections on port 80 serves nothing insecure, but anyone who reaches the plain address gets a connection error instead of your site. Answering on port 80 with a redirect is friendlier and just as safe.
* A connection that **times out** is reported as `ERROR`: from the outside it cannot be told apart from a network problem between 37AuditsBot and your server.
### What this auditor does not check
* Only the first answer is read. The auditor does not follow the redirect, so it does not check that the HTTPS address loads, nor how many hops the chain has.
* A redirect to a different host (`http://example.com` to `https://www.example.com`) passes. HSTS preloading needs the first hop to stay on the same host; see the [HSTS Preload auditor](/auditors/hsts-preload-auditor).
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.