HTTPS Redirect Checker
Confirm http:// 301-redirects to https://, HSTS is preserved across the chain, and the canonical https URL serves a 200. The basic test every site has to pass before SEO and security audits.
HTTPS enforcement
See whether http requests are redirected to https — and on which hop.
HSTS detection
Reads the Strict-Transport-Security header on the final hop.
Chain visualization
Each hop shows status code, latency, and target URL.
What it does
A focused HTTPS audit
Browsers, search engines, and security scanners all expect HTTPS by default. This tool verifies your site enforces it correctly: a 301 from http://, the right hop order, and an HSTS header on the final response.
http → https verdict
See whether the http:// version redirects to https://. A site without this redirect is a security and SEO liability.
HSTS header inspection
Reads Strict-Transport-Security on the final 200 response, including max-age, includeSubDomains, and preload flags.
Per-hop chain rendering
See exactly which hop performs the HTTPS upgrade. A clean setup is one 301 from http to https — never a chain of three.
Mixed-content warnings
When the final URL serves http resources, the canonical hop is flagged so you can fix it before browsers block the page.
Crawler perspective
Re-run with Googlebot. Some servers only return HTTPS redirects to user agents that include "Mozilla" — bots get raw HTTP.
API for CI gates
Hit /api/check from your deploy pipeline. Block ships that accidentally serve http instead of redirecting.
How it works
Three steps to a verdict
No login, no install — paste the http URL and read the chain.
- 1
Paste the http URL
Use http:// explicitly (not https://) so the tool can verify the upgrade happens.
- 2
Run the trace
We request the URL and follow every redirect, capturing status code and Location at each hop.
- 3
Read the chain
A correct setup is exactly one 301 from http:// to https://, then a 200 on the https URL with an HSTS header.
Who uses it
Anyone shipping a site to production
HTTPS is the default expectation. These are the people who get paged when it stops working.
DevOps shipping a TLS cert renewal
After a cert rotation, verify https still resolves and http still redirects. Catch the case where a misconfigured ALB serves http instead.
Security reviewers running site audits
Confirm the site meets the baseline: HTTPS enforced, HSTS present, no mixed-content warnings on the canonical URL.
SEO managers post-migration
Verify the http → https migration is clean: one 301 hop, no www mismatches, canonical pointing to https.
QA before launching a new domain
Make sure the launch checklist passes: http redirects to https on both www and apex.
Developers debugging "site not loading"
When a user reports "the site is broken," check whether HTTPS is enforced and HSTS is forcing the browser to stick to https.
Compliance / pentest follow-up
Closing tickets that require evidence the site enforces HTTPS? Screenshot the chain output as evidence.
Best practices
How to enforce HTTPS correctly
Five rules that keep your HTTPS setup honest and your visitors safe.
looks_one Single 301 from http to https
The cleanest setup: http://example.com → https://example.com with one 301. Avoid http://example.com → http://www.example.com → https://www.example.com chains.
security Set HSTS with a reasonable max-age
Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Start with a shorter max-age while you verify, then bump it up.
preliminary Consider HSTS preload only after the rest is solid
Preload is a one-way trip — once you submit to the HSTS preload list, browsers will refuse http even if you remove the header. Be sure before submitting.
shield Redirect at the edge, not in app code
Use your load balancer or CDN to do the http → https redirect. Application-level redirects add latency and break when the app is down.
travel_explore Verify HSTS reaches the final URL
Browsers only honor HSTS on https responses. If you send the header from the http response or from a redirect, browsers ignore it.
FAQ
Common HTTPS redirect questions
Why should http:// redirect to https://? expand_more
Three reasons. Security: http traffic is unencrypted and can be modified by anyone on the path. SEO: Google has used HTTPS as a ranking signal since 2014 and prefers https URLs in the index. UX: modern browsers display "Not Secure" warnings on http pages, and some features (geolocation, service workers, clipboard API) require HTTPS to work at all.
Is one redirect hop enough? expand_more
Yes — and one is the target. http://example.com → https://example.com in a single 301 is correct. Avoid setups where http redirects to www first, then to https — that adds an unnecessary hop and risks loops.
What does the HSTS header do? expand_more
Once a browser sees Strict-Transport-Security on an https response, it will refuse to load http on the same domain for the duration of max-age. This protects users from downgrade attacks. Combine with the preload list to protect users even on first visit.
Should I preload my domain? expand_more
Only after you have verified: HTTPS works on every subdomain, HSTS is sent with max-age ≥ 31536000 and includeSubDomains, and you intend to enforce HTTPS forever. Preload submission is hard to reverse — removing a preloaded domain takes months and you cannot serve any http during that time.
Why does this tool say HSTS is missing when my header is set? expand_more
Most common cause: the header is set on a redirect response, not on the final 200 response. Browsers only read HSTS from 200 responses on https. Move the header to the application or to the CDN policy that applies to https responses.
Does Google still treat HTTPS as a ranking signal? expand_more
Yes. It is a lightweight signal — site quality, content, and links matter more — but it is also a baseline. Google strongly prefers indexing the https version of a URL, and the http version will be deduped out of the index once redirects are in place.
Can I use this to test localhost? expand_more
No. The engine runs on Cloudflare Workers and can only reach publicly resolvable URLs. For local testing, use curl -IL http://localhost:3000.
Verify your HTTPS setup
Paste an http URL above and confirm it 301s to https with HSTS on the final response. Free, no signup.
north Run HTTPS check