HTTP to HTTPS redirect: how squirrel probes for it
squirrel requests the http:// version of a sample of your URLs and reports which ones redirect to HTTPS, with the status code of the first hop.
What an HTTP to HTTPS redirect is
An HTTP to HTTPS redirect is a response on port 80 that sends the client to the https:// form of the same URL. It exists because links, bookmarks and typed addresses still arrive over plain HTTP, and without a redirect they either fail or serve a duplicate copy of the site on an insecure origin.
Search engines treat http://example.com/page and https://example.com/page as separate URLs. A permanent redirect consolidates them and keeps the HTTPS version as the indexed one. HSTS eventually removes the need for the redirect in browsers that have already seen the header, but the redirect is what handles the first visit and every non-browser client.
What squirrel checks
The rule is site-wide and makes live network requests. It builds a sample of same-hostname URLs starting with the base URL, adds crawled pages whose status code is under 400 until the sample limit is reached, rewrites each to http:// and follows the redirect chain. It emits a single check named http-to-https:
- Skipped when there is no base URL. Message:
No base URL available. - Skipped when the base URL does not parse. Message:
Invalid base URL. - Skipped when the base URL is not HTTPS. Message:
Base URL is not HTTPS. - Warn when at least one probed URL redirects to HTTPS. Message:
12 HTTP URL(s) redirect to HTTPS, with each entry labelledhttp://example.com/ → https://example.com/ (301). - Pass when none do. Message:
No HTTP to HTTPS redirects detected in sample.
Read the warn status as an inventory rather than a defect: it lists the HTTP URLs that are still reachable and redirecting. Probes run five at a time with a 100 ms stagger, each hop times out after 10 seconds and chains stop at 10 hops. A 20 second budget stops workers picking up new URLs, so the rule reports on the subset it started; probes already in flight are still awaited and can finish after the budget expires. Redirect loops are skipped.
How to fix it
server {
listen 80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}Redirect in one hop, preserving the path and query string, and use 301 rather than 302 so the target is the canonical URL. Chaining HTTP to HTTPS to a canonical host costs a round trip on every first visit.
| Rule ID | security/http-to-https |
| Category | Security |
| Scope | Site-wide |
| Severity | warning |
| Weight | 3/10 |
Options
| Option | Type | Default | Description |
|---|---|---|---|
sampleLimit | integer, 1 to 100 | 20 | Maximum number of pages to probe for HTTP to HTTPS redirects |
Configuration example
[rule_options."security/http-to-https"]
sampleLimit = 40Enable / disable
Disable this rule
[rules]
disable = ["security/http-to-https"]Disable all Security rules
[rules]
disable = ["security/*"]Enable only this rule
[rules]
enable = ["security/http-to-https"]
disable = ["*"]Related rules
- security/https: the pages themselves, checked without any network probe.
- security/hsts: the header that lets browsers skip the redirect entirely.
- crawl/redirect-chain: multi-hop chains, including the ones this redirect can create.
- links/https-downgrade: internal links that make the browser take the redirect on every click.
Security findings ship in every audit next to the SEO, performance and agent experience rules. See Website security scan with AI for how an agent works through a report.
References
Check your site
Run squirrel audit https://example.com and open the Security section of the report. Each probed HTTP URL is listed with its destination and status code. Local audits are free.