Defaults.Exposed › October 2026 census › v10 registry › HTTP→HTTPS redirect
HTTP→HTTPS redirect
Methodology v10 · canonical ID http-to-https-redirect · Web Security · scored
Sends visitors who arrive on http straight to the secure version.
HTTP→HTTPS redirect: definition
| Canonical ID | http-to-https-redirect |
|---|---|
| Category | Web Security |
| Grade impact | Scored, counts toward the grade |
| Pass | Requests to http://<domain> are redirected (301/302/307/308) to the https:// origin. |
| Fail | Plain-HTTP requests are served content without redirecting to HTTPS (Hypertext Transfer Protocol Secure). |
| Example (passing) | http://example.com/ → 301 → https://example.com/ |
HTTP→HTTPS redirect across the census
51.3% of domains whose HTTP (Hypertext Transfer Protocol) redirect behaviour could be observed redirect plain-HTTP requests to HTTPS (108,376,735 of 211,262,083, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
HTTP→HTTPS redirect is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 121,230,236 of the 332,492,319 graded domains had no determinable result for this check: the plain-HTTP fetch itself has to answer before redirect behaviour can be observed.
Every outcome in the census
| Outcome | Domains | Share of domains whose HTTP redirect behaviour could be observed | In the headline figure |
|---|---|---|---|
| Plain-HTTP request redirected to HTTPS | 108,376,735 | 51.3% | Yes |
| Plain-HTTP request not redirected | 102,885,348 | 48.7% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
Against the other checks
Among the 6 Web Security checks with a published figure, HTTP→HTTPS redirect has the 1st highest pass share. Next below it is HSTS (HTTP Strict Transport Security): 21.4% of HTTPS-serving domains. Across every check with a published figure it ranks 11th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix HTTPS & forced-secure redirect
Cite this check
Defaults.Exposed, "HTTP→HTTPS redirect (http-to-https-redirect)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/http-to-https-redirect
Permalink: https://defaults.exposed/methodology/http-to-https-redirect ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data