SEC-002
HTTP does not redirect to HTTPS
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Requests the http:// version of the site and checks that it redirects to https://.
Why it matters
Visitors who type the address or follow old links stay on an unencrypted connection.
Recommended fix
Add a permanent redirect from http:// to https:// at the hosting or proxy layer.
How to verify
Request http://your-domain/ and confirm a 301/308 with a Location header starting with https://.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-002: HTTP does not redirect to HTTPS
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add a permanent (301 or 308) redirect from http:// to https:// for every path, at the hosting platform or edge config, keeping the path and query string.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request http://your-domain/ and confirm a 301/308 with a Location header starting with https://.