How to force HTTPS for all traffic?

https-not-enforced global

The issue

A site that still answers over plain HTTP lets anyone on the network read and change what a visitor sees, including the login form. Even a site that redirects to HTTPS leaves the first request open unless browsers are told never to use HTTP for it.

The cause is one of two missing pieces: a redirect from every HTTP URL to its HTTPS twin, and the Strict-Transport-Security header that makes browsers skip HTTP next time.

Scope

Both apply to the whole hostname, and each subdomain needs its own unless the main host’s policy uses includeSubDomains. Probeo checks the Strict-Transport-Security header on each response it fetches. Its header checks don’t request the HTTP version of the URL.

How to check you have it

• In probeo: a response without HSTS is recorded as hsts-missing, and a short one as hsts:short-max-age.
• By hand: run curl -sI http://example.com/some/path?x=1 and confirm a 301 to the same path and query on https://. Then run curl -sI https://example.com/ and look for strict-transport-security.

FAQ

Should redirects use 301 or 302 status codes?

301 Moved Permanently signals the redirect is permanent. Browsers and search engines cache permanent redirects. 302 Found indicates a temporary redirect that should not be cached. Use 301 for HTTP to HTTPS redirects because the change is permanent. The status code difference matters for search engine handling and client caching behavior.

Does HSTS prevent the first HTTP request?

Not without preload. The first visit to a site must complete before browsers learn about HSTS. This first request is vulnerable to interception and downgrade attacks. HSTS preload solves this by including domains in a browser-embedded list. Sites on the preload list start with HTTPS enforcement even on first visit. Preload requires specific HSTS configuration and submission to the preload list.

What breaks when forcing HTTPS if the certificate is invalid?

Browsers block access with certificate warnings. Users cannot easily bypass these warnings in modern browsers. The site becomes inaccessible until certificate issues resolve. Ensure certificates are valid, not expired, and cover all hostnames before forcing HTTPS. Test HTTPS thoroughly before adding HSTS headers with long max-age values.

Should APIs and subdomains also force HTTPS?

Yes. All hostnames including APIs, admin panels, and subdomains should force HTTPS. API credentials and data require the same protection as web pages. Use includeSubDomains in HSTS headers carefully because it applies the policy to all subdomains. Verify every subdomain supports HTTPS before enabling includeSubDomains or they become inaccessible.

How does HSTS affect development and staging environments?

HSTS applies to hostnames, not environments. Using production hostnames in development with HSTS causes browsers to require HTTPS in development too. Use different hostnames for development and staging that are not in the HSTS preload list. Alternatively, ensure development environments support HTTPS with valid certificates. Clearing browser HSTS state requires manual browser intervention and is not user-friendly.

Can load balancers handle HTTP to HTTPS redirects?

Yes. Most load balancers and reverse proxies support HTTP to HTTPS redirects without reaching application servers. Configure redirects at the infrastructure level for better performance. Application servers still need HSTS headers on HTTPS responses. Redirecting at the load balancer prevents HTTP requests from traversing internal networks unnecessarily.