HTTP to HTTPS redirect: force HTTPS in plain English
If someone types http://yourdomain.com, the server should answer with a redirect to https://—not serve the same page (or a different one) over cleartext. That jump is the HTTP→HTTPS redirect CrowWake watches.
What an HTTP to HTTPS redirect does
Browsers still try plain HTTP when users omit the scheme, follow old bookmarks, or hit http:// links in email. A correct redirect responds with 301, 302, 307, or 308 and a Location that starts with https://. The browser then loads the secure URL. Without that jump, cookies, forms, and pages can leak on the wire—and mixed “sometimes HTTP” setups confuse HSTS rollout.
What CrowWake checks
We request http:// on the apex without following redirects and look for a 3xx status whose Location points at HTTPS. Cleartext 200 that serves content → warn. Odd status with no HTTPS Location → warn. Clean 3xx → HTTPS → ok. The free security headers checker uses the same redirect signal with no login; CrowWake’s hourly flock watches it afterward so a CDN or panel change does not silently reopen HTTP.
301, 302, 307, 308 — which status?
301 (Moved Permanently) and 308 (Permanent Redirect) tell browsers and search engines the HTTPS URL is the lasting home—prefer these for production apex/www. 302/307 are temporary; fine while testing, but switch to permanent once HTTPS is the only public face. CrowWake cares that the Location is HTTPS more than which 3xx you pick.
Redirect first, then HSTS
Force HTTPS at the edge or origin before you publish a long-lived Strict-Transport-Security header. HSTS remembers “HTTPS only” in the browser; a broken or missing redirect while you still rely on HSTS for first visits leaves a gap. Pair the redirect with a healthy cert (SSL expiry checker) and only then raise HSTS max-age—see the HSTS guide.
Quick publish triage
1) Run the free security headers checker and note the redirect row. 2) Confirm HTTPS itself answers (site + SSL checkers). 3) Add a force-HTTPS rule at the CDN, load balancer, or web server (apex and www if both are live). 4) Re-check: HTTP should 3xx to https:// with no cleartext body. 5) Add the domain so CrowWake crows if the redirect disappears after a rebuild.
If CrowWake crows
HTTP serves content → enable force-HTTPS / “Always Use HTTPS” at CDN or origin. Redirect loops or wrong host → fix Location to the canonical https hostname. Present then gone → restore the rule after a theme, panel, or “simplify edge” change. After a fix, re-run the free security headers checker and keep watching. Deep dives: HSTS, X-Frame-Options, and X-Content-Type-Options use the same checker.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free security headers checker with no login.
Related: security headers monitoring, HSTS guide (turn on after the redirect is solid), X-Frame-Options, X-Content-Type-Options, the security headers & open ports guide, and the free SSL expiry checker.