Site accessible over HTTP without redirect to HTTPS

This check requests the site over plain, unencrypted HTTP rather than secure HTTPS, and checks whether it's automatically redirected to the secure version. On this site, the plain HTTP address loads directly with no redirect to HTTPS, meaning a visitor who reaches the site this way gets a fully unencrypted connection. Any visitor who types the bare domain without https://, or clicks an old link that still points to the HTTP version, gets a completely unencrypted session, because their browser has no way to know it should upgrade the connection on its own. Every page request, form submission, and cookie in that session is readable by anyone else on the same network path. Your developer should add a permanent 301 redirect from the http:// version of the domain to the https:// version, configured at the web server or CDN, content delivery network, level. This is a standard, well-documented configuration in Cloudflare, Nginx, Apache, and IIS, and typically takes about 30 minutes. Pair it with HSTS preload for complete protection against downgrade attempts.