FmindSecurity guide
Send visitors to the secure site (HTTPS redirect)
Visitors who type your address without “https://” may stay on an unencrypted page, where what they read or type (such as contact form details) can be seen or altered, for example on public Wi-Fi.
Who can help
Your web host or web developer
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- Run this read-only request for the exact saved address without following redirects, and compare the status and next URL with the expected HTTPS address. A browser switching to HTTPS on its own (because of HSTS) is not the same as a server redirect.
curl -q --connect-timeout 5 --max-time 10 --max-filesize 131072 --proto '=http' --silent --show-error --output /dev/null --write-out 'HTTP %{http_code}\nNext URL: %{redirect_url}\n' 'http://YOUR_HOSTNAME/'What to do
First make sure your whole site works over HTTPS, including forms and checkout. Then ask your host or developer to turn on the HTTP-to-HTTPS redirect, often a single setting in the hosting panel or Cloudflare. Check that pages don’t end up in a redirect loop, and keep a way to switch the setting back.
How to verify the change
In a private window, type your address starting with http://: you should end up on the https:// version of the same address. Then run this check again: this item should show Good.
What this check can establish
We only follow the redirect from your homepage; other pages, links and logged-in areas are not tested.