HTTP to HTTPS redirect: Crawl Audit check 48

Short answer: anyone who types your domain without https://, or follows an old link, should land on the secure version of your site automatically. Check 48 tests exactly that: Crawl Audit starts at http:// and checks the visit ends up on https://. If it doesn't, the check fails. It's rated high impact, and it's one of the easiest fixes on the list.

What Crawl Audit checks

Crawl Audit opens http://yourdomain.com and follows the redirects.

• Pass: the final URL starts with https://.
• Fail: it stays on http://.

For devmarde.com it's one hop: http://devmarde.com/ returns a permanent 308 redirect to https://devmarde.com/. Checks 49 and 50 look at that same redirect: how many hops it takes, and whether it's permanent.

What Google says

• "Google prefers HTTPS pages over equivalent HTTP pages as canonical".
• Among the ways to make sure Google picks the HTTPS version: "Add redirects from the HTTP page to the HTTPS page."
• Google counts "URL changes from HTTP to HTTPS" as a site move, and says "we recommend that you use HTTP permanent redirects if possible, such as 301 and 308".

HSTS: the step after the redirect

A redirect still lets the first request go out over plain HTTP. The Strict-Transport-Security header "informs browsers that the host should only be accessed using HTTPS", so after one visit the browser goes straight to HTTPS. MDN notes that if the host accepts insecure HTTP requests, it "should respond with a permanent redirect". In short: redirect first, then add HSTS.

On your platform

• Shopify: TLS certificates are free for all connected domains, and "If your customers use the original URL, then they're redirected automatically to the encrypted online store."
• Wix: "All sites created on Wix have HTTPS automatically enabled at no additional cost."
• Squarespace: once the certificate is issued and the setting is on Secure, "Visitors are always redirected to HTTPS".
• Vercel (and Next.js sites hosted there): "The CDN automatically forwards any HTTP requests to your deployment to HTTPS using the 308 status code", and this "can't be disabled".
• WordPress: WordPress works with HTTPS once a certificate is installed, but its documentation doesn't say it adds the redirect itself. Check with your host, and test http:// after setting it up.

Sources

• Google Search Central, How to specify a canonical URL and Site moves with URL changes, checked 3 October 2026.
• MDN, Strict-Transport-Security.
• Shopify, Secure connections; Wix, About SSL and HTTPS; Squarespace, SSL certificates; Vercel, Encryption; WordPress, HTTPS.