Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

Redirects to HTTPS

Plain HTTP sends visitors to HTTPS

Does typing the plain address end up on HTTPS?

Why it matters

People type addresses without a scheme, so the first request often leaves unencrypted. Redirecting it straight to HTTPS keeps that first visit from being read or rewritten on the way.

When a domain passes

Passes when plain HTTP redirects to HTTPS, or when plain HTTP is not served at all.

How to fix it

  1. Answer every plain HTTP request with a permanent redirect to the same path over HTTPS.
  2. Then add HSTS so the browser skips the plain request next time.

Reference specifications

All thirteen standards