Home / Learn / HTTPS Enforcement — Redirects, HSTS & Mixed Conten

HTTPS Enforcement — Redirects, HSTS & Mixed Content

Having a valid SSL certificate isn't the same as actually enforcing HTTPS everywhere. This 5-point module checks something different from the SSL/TLS module: whether plain http:// requests are properly redirected to HTTPS, whether HSTS is configured to lock that behaviour in at the browser level, and whether the redirect chain itself is clean and direct.

🌿 Beginner — Plain English explanations

Having HTTPS available isn't the same as enforcing it

Many sites install an SSL certificate but still leave the plain http:// version of the site accessible. That means anyone who types your domain without https://, clicks an old link, or gets sent there by an out-of-date bookmark lands on the unencrypted version — even though the secure version exists right next to it.

What proper enforcement looks like

Automatic redirect — every request to http://yourdomain.com should immediately and permanently redirect to https://yourdomain.com, with no detour through an insecure page first.
HSTS (HTTP Strict Transport Security) — a header that tells the browser "remember this, and never even attempt an insecure connection to this domain again," closing the tiny window of risk that exists on that very first request.
HSTS max-age & includeSubDomains — the header needs a long enough lifetime (1 year+) and the includeSubDomains flag to actually qualify for real browser preload list submission — having the header at all isn't automatically enough.
HSTS preload list status — the strongest signal available: whether your domain is actually baked into Chrome/Firefox/Safari's built-in preload list, not just theoretically eligible based on your current headers.
Clean redirect chains — ideally one redirect (HTTP → HTTPS), not a chain bouncing through multiple hops, which slows down every visit and confuses search engine crawlers.

Why it matters

Without enforcement, a user on public Wi-Fi who reaches the HTTP version even briefly is exposed to interception during that request, and to an attacker rewriting the page before the redirect fires (a technique called SSL stripping). Real preload list inclusion is what closes this gap entirely — without it, even a correctly-configured redirect can't protect a user's very first visit.

How to fix it

Most modern hosts (Kinsta, WP Engine, Cloudflare) offer a one-click "Force HTTPS" toggle in the dashboard. Once your HSTS header has a sufficient max-age and includeSubDomains, submit your domain at hstspreload.org for the strongest possible guarantee.

Check Your Website Now — Free

PEKRYON scans your website across 26 modules. We take the time needed for accurate results — no server access needed.

Scan My Website Free → Learn More