TrueURL
TrueURL

Menu

Language English
Theme

Free redirect tool

HTTPS Redirect Checker

Enter a domain to test the four ways people can reach it: http and https, with and without www. Each one should arrive at the same HTTPS address in a single permanent redirect.

What the HTTPS check tests

For the host you enter, TrueURL builds four starting URLs and traces each one:

  • http://example.com
  • http://www.example.com
  • https://example.com
  • https://www.example.com

In a healthy setup, all four end on one canonical HTTPS URL. That version answers 200 OK directly, and the other three reach it with a single 301 or 308. Any hop that goes from HTTPS back to HTTP is flagged.

TrueURL also checks HSTS. It reads the Strict-Transport-Security header from the final HTTPS response (normally your canonical URL) and shows the raw value, the max-age and whether includeSubDomains and preload are set. A max-age of at least one year passes. A shorter max-age, max-age=0, a header without a valid max-age or no header at all is shown as a warning.

Common HTTPS redirect problems and fixes

  • No redirect from HTTP: the http:// version shows the page instead of redirecting. Add a site-wide redirect to HTTPS; a canonical tag alone doesn't protect visitors.
  • Two or more hops: for example http://example.com to https://example.com to https://www.example.com. Combine the scheme and host rules so every variant goes straight to the final URL (but see the HSTS preload exception below).
  • Temporary redirect: a 302 or 307 from HTTP to HTTPS. Use 301 or 308 so search engines index only the HTTPS version.
  • HTTPS downgrade: a hop from https:// back to http://, usually a stray rule or an application behind a proxy or CDN that builds absolute URLs with the wrong scheme.
  • Certificate errors: one variant, often www, isn't covered by the certificate. Cloudflare's edge always validates certificates, so that variant shows a TLS error instead of a redirect.
  • Variants that disagree: www and non-www end on different URLs, which splits signals between two hosts.

HSTS and the preload exception

HSTS tells browsers to use HTTPS for your domain automatically, without requesting HTTP first. A typical header is Strict-Transport-Security: max-age=31536000; includeSubDomains. Browsers only accept it on HTTPS responses and ignore it on plain HTTP.

If you want to add your domain to the browsers' HSTS preload list at hstspreload.org, the first hop from HTTP has to stay on the same host: http://example.com to https://example.com, and only then to https://www.example.com. That two-hop chain is the accepted exception to the single-hop rule. The header then needs a max-age of at least one year, includeSubDomains and preload, and it must also be sent on the HTTPS redirect itself.

After switching to HTTPS

  • Update internal links, canonical tags, hreflang annotations and your sitemap to the HTTPS URLs, so crawlers don't keep hitting redirects.
  • Keep the HTTP to HTTPS redirect forever; old links will point to http:// for years.
  • Make sure the HTTPS version of your site is verified in Google Search Console and submit the updated sitemap.
  • Check again after any CDN, hosting or certificate change.

Guides

Frequently asked questions

How do I check if HTTP redirects to HTTPS?

Enter your domain above. TrueURL requests the http:// and https:// versions, with and without www, and shows where each one ends up, which status codes were used and how many hops it took. Your setup is right when all four reach the same HTTPS URL and every redirect is permanent.

Should I use www or non-www?

Either works for SEO. What matters is choosing one, redirecting the other to it with a 301 and using it consistently in links, canonical tags and your sitemap. A www host can be easier to point at a CDN, because DNS doesn't allow a CNAME record on the root domain (some DNS providers offer workarounds), but that's a technical choice, not a ranking factor.

Why does Chrome DevTools show a 307 for HTTP to HTTPS?

That "307 Internal Redirect" is created by Chrome itself because the site is in its HSTS list, so no request was sent over HTTP at all. The server's real redirect may be a 301 or something else entirely. TrueURL has no HSTS cache, so it always shows the server's actual response.

Is a 302 from HTTP to HTTPS a problem?

A small one. Visitors still end up on HTTPS, but a temporary redirect tells search engines the HTTP URL may come back, which can slow down or muddle the switch. Change it to a 301 or 308.

How do I check whether my site sends HSTS?

Enter your domain above and open the HSTS check in the results. TrueURL reads the Strict-Transport-Security header from the final HTTPS response and shows its value, the max-age (with a warning below one year) and whether includeSubDomains and preload are set. Without the header, every visit that starts from a typed domain or an old http:// link begins with an unencrypted request, which someone on the same network could intercept. With it, browsers that have seen the header go straight to HTTPS next time. Start with a short max-age, confirm that every subdomain works over HTTPS before you add includeSubDomains, then raise it to a year or more.

Can I test a site with an invalid or expired certificate?

You'll see the problem, but not past it. Certificate validation can't be switched off on Cloudflare's edge, even with Ignore SSL Errors turned on, so the affected variant shows a TLS error on that hop. That's usually what you need to know anyway: browsers will show visitors a warning there too.

Do I need to redirect every page, or just the home page?

Every URL. A site-wide rule should send http://example.com/any/path?query to the same path and query on HTTPS. Test a few deep URLs with the Redirect Chain Checker, or many at once with the Bulk Redirect Checker.