HTTP redirects to HTTPS

What this means

Passing means a request to http://YOUR_DOMAIN answers with a 301 or 308 whose Location is the https:// address. Failing means the plain address serves your page as it is, or redirects somewhere other than the secure address. A visitor who types your domain without a scheme starts on http, so this redirect is the step that moves them onto the encrypted connection.

How we test it

We request http://YOUR_DOMAIN/ and read the status line and the Location header, following at most three redirects. A 301 or 308 to an https:// URL passes. A 302 or 307 to https:// warns, because browsers do not remember a temporary redirect. A 200 over plain http, or a redirect that lands anywhere other than https://, fails.

Why it matters

Without it, sessions and forms can be read on the wire. Anyone on the same network as your visitor can see what they type and the cookies they carry, and can rewrite the page they receive. The HSTS header depends on this redirect too: a browser only learns to insist on https after it has arrived there once. The kit's rule for redirects applies here as well: this host-level hop is one of the few redirects whose target never changes, so it is allowed to be permanent.

The fix

Make the host answer every http:// request with a permanent redirect to https://, at the host or edge in front of the app rather than in page code, which hosts such as Vercel do for an attached domain; this hop and the www to apex choice from Module 0 are the only redirects the kit allows to be permanent: true. Verify with curl -sI http://YOUR_DOMAIN/ and read the Location line, which must begin with https://. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -sI http://YOUR_DOMAIN/ | head -5 and show me the output.
Tell me the status code and the Location header exactly as printed.
Run: curl -sI http://www.YOUR_DOMAIN/ | head -5 and report the same.
Open vercel.json or next.config at the repo root and list every entry under redirects, with its permanent value, or tell me there are none.
List what it would take for plain http to answer with a 301 or 308 to https://, and stop there.
Run: curl -sI http://YOUR_DOMAIN/ | grep -iE '^(HTTP|location)' and show me the output. Expected on a passing site: a 301 or 308 status line and a Location beginning with https://YOUR_DOMAIN.