I have a valid certificate. Why does this matter?

Because the certificate only protects requests that reach https. A visitor arriving at http:// sends one unencrypted request first, and the redirect telling them to use https is itself unencrypted — so it can be stripped or rewritten in transit. HSTS is the fix: after one successful https visit, the browser refuses to send that plaintext request at all.

Should the http to https redirect be a 301 or a 302?

301, or 308 if the request method must be preserved on a POST. Both are permanent, which is what a move to https is. A 302 tells search engines to keep indexing the http URL and to treat the https one as a temporary detour, so link signals stay on the insecure version.

What is a safe HSTS max-age to start with?

Start low — 300 seconds — and confirm nothing on the domain still needs http. The header is not revocable in any practical sense: a browser that has seen max-age=31536000 will refuse http for that domain for a year, whatever you do next. Once you are confident, raise it to 31536000, which is the minimum the preload list accepts.

What does includeSubDomains actually change?

It extends the policy to every subdomain, including ones you have forgotten. That is the point — a subdomain served over http can be intercepted, and a cookie set there can be read on the parent domain. It is also why it needs care: any subdomain still on http becomes unreachable once the policy is in force.

Why does preload need includeSubDomains?

Because the preload list applies to the whole domain by definition — it is compiled into browsers before any visit, so there is no way to scope it to one hostname. A policy carrying preload without includeSubDomains is rejected by hstspreload.org, and the token does nothing in the meantime.

Does an http to https redirect hurt SEO?

No, a single permanent redirect is the correct way to migrate and passes ranking signals. What hurts is serving both versions with a 200, which creates a duplicate of every page on the site, and using a 302, which leaves the signals on the URL you are trying to retire.

SEO

HTTPS Redirect Checker

Check that http:// reaches https:// in one permanent hop, and that HSTS closes the plaintext window it leaves open.

100% free
No sign-up

The short version

What is HTTPS Redirect Checker?

A padlock in the address bar says the connection you are looking at is encrypted.

It says nothing about the one before it. Almost every visit to a site still starts at http:// — typed without a protocol, followed from an old link, printed on something — and that first request travels in the clear, including the redirect that sends it to https. Anyone on the network path can rewrite that redirect before the browser ever sees your certificate. This checker follows the chain from http:// and reports two things: how many requests happen in plaintext before https begins, and whether Strict-Transport-Security is set so the browser stops making them. The common three-hop chain, http to http-www to https-www, is worth finding: it doubles the exposure and buys nothing, because the www change could have happened after the upgrade.

Step by step

How to use HTTPS Redirect Checker

1
Enter the bare domain
Type example.com rather than a full URL. The checker starts at the http:// version on purpose — that is the request being tested.
2
Look at the hop count first
One hop from http to https is the target. Two or more plaintext hops is a real finding, not a style note.
3
Check the status code of the upgrade
A 302 tells search engines the insecure URL is the canonical one and this is temporary, so ranking signals stay on http.
4
Then read the HSTS line
Without it, the plaintext request happens on every first visit forever. With a year of max-age and includeSubDomains, it happens once.

What's inside

Everything this tool
does for you

Full hop-by-hop chain starting at http://
Counts the requests that happen before encryption starts
Permanent (301/308) versus temporary (302/307) upgrade detection
HSTS max-age checked against the one-year preload minimum
includeSubDomains and preload token validation
Flags an https URL that errors even though http redirects correctly

Understand the result

Related free tools

All SEO tools

Meta Tag Generator

Import metadata from a URL or edit SEO and social tags, preview them, and copy the generated HTML.

SEO

Meta Tag Analyzer

Inspect page metadata, social tags, response directives and actionable fixes from a URL.

SEO

Open Graph Tag Generator

Generate Open Graph meta tags with live Facebook and LinkedIn preview.

SEO

Open Graph Checker

Check any URL's Open Graph tags and preview how links appear on social media.

SEO

Twitter Card Generator

Generate Twitter Card meta tags with live preview for summary and large image cards.

SEO

Robots.txt Generator

Build a robots.txt file with a visual editor. Add rules for any user agent.

SEO

Questions

Frequently asked questions

Beyond this tool

See the full picture for your website.

Enter your URL for a free audit across eight scored areas. See prioritised issues and clear next steps in one report.

Run a free website audit

Free to start · No signup required

What this tool does

Follows every hop from http:// and shows which ones are plaintext
Checks the upgrade is a 301 or 308, not a temporary 302
Reads the HSTS policy: max-age, includeSubDomains, preload
Catches preload set without includeSubDomains, which the list rejects
Free, no account, no daily limit

Want the whole picture? Run a free website audit for a score and prioritised issues. No signup needed to start.Run a free audit