HTTPS: encrypt every request, and redirect the ones that aren't

The threat

Our scanner reached your site over plain http:// and the connection was never encrypted: either the page loaded as-is over http, or there was no redirect bouncing it up to https://. On an unencrypted connection, everything a visitor types (a password, a card number, a contact-form message) travels in readable text. Anyone sharing the network path (the coffee-shop wifi, the router, a hop at the ISP) can read it, and the browser now stamps a “Not secure” label in the address bar before anyone reads a word.

It is not only eavesdropping. Without TLS the page itself can be rewritten in transit: an injected ad, a swapped payment detail, a fake login field, all slipped in before the page reaches the visitor. The fix is two parts that go together: serve the site over a valid certificate, and make sure every http:// request is permanently redirected to https://.

The exact fix

On Netlify you do not manage certificates by hand. Point your domain’s DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. at Netlify and it auto-provisions a free Let’s Encrypt certificate within a few minutes. Then, under Domain management in the HTTPS section, turn on Force HTTPS. That single toggle 301-redirects every http:// request to https://, site-wide.

On nginx, keep a redirect-only server block on port 80 and serve the real site on 443:

# nginx: send every http request to https
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;
    # ssl_certificate / ssl_certificate_key go here
}

On Apache, force the redirect from the port-80 vhost (or .htaccess):

# Apache: force https
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

• Use a 301 (permanent), not a 302, so browsers and search engines remember it.
• Redirect every path, not just the home page.
• Make sure the certificate covers both the apex (yourdomain.com) and www.

Do this next: a redirect still lets the very first request go out over http before it fires. Once HTTPS is forced, add the Strict-Transport-Security header (see the HSTSHSTSHTTP headerHTTP Strict Transport Security: a header that forces browsers to always use HTTPS for your domain, defeating downgrade and SSL-strip attacks. fix page) so browsers refuse http for your domain from the start.

Verify it

curl -sI http://yourdomain.com | grep -iE "http/|location"

You want a 301 whose location: points at the https:// version of the same URL. Load the site in a browser afterward and the address bar should show the padlock, not Not secure.

Proof

apecyber.com is served entirely over https on Netlify and scores A / 100; dev3lop.com went from a failing grade to that same A / 100. The ApeCyber scanner catches a missing http-to-https redirect passively, from the outside, touching nothing. Turning the redirect on is a clean −20 off the posture score.