Validates HTTP to HTTPS redirect configuration
HTTP address: the audited URL is turned into its http:// form (https://example.com/shop becomes http://example.com/shop; a URL without a scheme gets http://).
Fetch: sends a HEAD request (or GET when HEAD is answered with 405) to that address as 37AuditsBot, without following redirects. A blocked request ends the audit with 590. A refused connection (nothing listens on the HTTP port) warns with 301. A timeout, DNS failure or HTTP 5xx ends the audit with 500.
Location: the Location header is resolved against the HTTP address, so a relative Location: /shop points at http://example.com/shop.
Rules: an answer that is not a redirect (400), a redirect without Location (401) and a redirect to an address that is not HTTPS (402) fail. A temporary redirect to HTTPS (302, 303 or 307) warns (300).
Aggregate: FAIL wins over WARNING. A permanent redirect (301 or 308) to an HTTPS address is SUCCESS (200).
Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 200 success, 300–399 warning, 400–499 fail, 500–599 error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-HttpRedirectAuditor-400 | FAIL | The HTTP address answers with a status that is not a redirect (200, 404, …). | Make {httpUrl} answer with a 301 redirect to {httpsUrl}. | Visitors and links that use http:// get the site over an unencrypted connection, where anyone on the same network can read or change the pages, forms and cookies. |
37A-HttpRedirectAuditor-401 | FAIL | The HTTP address answers with a redirect status but no Location header. | Add "Location: {httpsUrl}" to the HTTP {status} response of {httpUrl}, or switch it to a 301 redirect to that address. | A redirect without a destination leaves browsers on an error page, so visitors who type the plain address never reach the site. |
37A-HttpRedirectAuditor-402 | FAIL | The redirect Location, resolved against the HTTP address, is not an https:// address. | Change the Location of {httpUrl} from "{location}" to {httpsUrl} and use a 301 redirect. | Visitors stay on an unencrypted connection after the redirect, so passwords, forms and cookies can be read or altered by anyone on the same network. |
37A-HttpRedirectAuditor-300 | WARNING | The HTTP address redirects to HTTPS with a temporary status: 302, 303 or 307. | Change the HTTP {status} redirect of {httpUrl} to {target} into a permanent one: 301, or 308 to keep the request method. | Browsers and search engines do not remember a temporary redirect, so every visit starts with an unencrypted request and search rankings may stay attached to the insecure address. |
37A-HttpRedirectAuditor-200 | SUCCESS | All rules passed. Message is {httpUrl} redirects permanently (HTTP {status}) to {target}. | — | — |
37A-HttpRedirectAuditor-301 | WARNING | The server refuses connections on the HTTP port (nothing listens on it). | Open port {port} on {host} and answer {httpUrl} with a 301 redirect to {httpsUrl}. | Nothing is served without encryption, but visitors who follow an old http:// link or type the address in a browser that does not upgrade to HTTPS get a connection error instead of the site. |
37A-HttpRedirectAuditor-500 | ERROR | The HTTP address could not be checked: timeout, DNS failure or HTTP 5xx. | Make sure {httpUrl} answers within 20 seconds, then run the audit again. Last error: {error}. | — |
37A-HttpRedirectAuditor-590 | ERROR | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See https://www.37audits.com/bot. | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | The HTTP address redirects permanently to HTTPS | 301 or 308 with a Location that resolves to https:// (200). |
| WARNING | The redirect is temporary, or the HTTP port is closed | 302, 303 or 307 to HTTPS (300); connection refused (301). |
| FAIL | Visitors can stay on plain HTTP | No redirect (400); redirect without Location (401); redirect to a non-HTTPS address (402). |
| ERROR | The auditor could not check the HTTP address | Timeout, DNS failure or HTTP 5xx (500); site blocked 37AuditsBot (590). |
Browsers increasingly try HTTPS first, but old links, bookmarks, emails, QR codes and some clients still use http://. Without a redirect, those visitors see the site unencrypted, and anyone on the same Wi-Fi can read or change what they see and send.
301 and 308 are permanent: browsers cache them, so later visits skip the insecure request, and search engines move ranking signals to the HTTPS address. 308 also keeps the request method (a POST stays a POST).
302, 303 and 307 are temporary: the browser asks over plain HTTP on every visit, which leaves a window for an attacker to answer first.
A server that refuses connections on port 80 serves nothing insecure, but anyone who reaches the plain address gets a connection error instead of your site. Answering on port 80 with a redirect is friendlier and just as safe.
A connection that times out is reported as ERROR: from the outside it cannot be told apart from a network problem between 37AuditsBot and your server.
Only the first answer is read. The auditor does not follow the redirect, so it does not check that the HTTPS address loads, nor how many hops the chain has.
A redirect to a different host (http://example.com to https://www.example.com) passes. HSTS preloading needs the first hop to stay on the same host; see the HSTS Preload auditor.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.