HTTPS
Serving a site over plain HTTP exposes every request to anyone on the path. The redirect config for nginx, Apache and Netlify, and what comes next.
What it is
This check reads the scheme of the URL that was scanned and fails when it is http rather than https. It is the first security check to run, and when it fails the rest are skipped — there is no useful question to ask about a Content-Security-Policy header on a connection anyone can rewrite in transit.
It is the one check here with no nuance to it. Certificates have been free and automatable for a decade.
Why it matters
On plain HTTP every request and response travels in the clear: what was read, what was submitted, what came back. Anyone on the path — a coffee shop network, a compromised router, an ISP — can read it and, more importantly, change it before it arrives.
The change-it-in-transit part is what most people underestimate. HTTP does not merely fail to keep a page private; it fails to guarantee the page a visitor sees is the page you sent.
How to fix it
with a reference docserver {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]http://example.com/* https://example.com/:splat 301!Related checks
4This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.