Is HTTPS enforced on your site?
Whether your homepage loads over HTTPS, and whether the plain http:// address of your site sends visitors on to the secure version.
Why it matters
Without HTTPS, anyone on the same network as your visitor, such as public Wi-Fi in a café, can read or change what passes between them and your app: sign-in details, form entries and the pages themselves. Browsers also mark plain HTTP pages as not secure, which costs trust before anyone reads a word.
How a survey checks it
Passive check: part of every free survey.
We request the http:// and https:// addresses of your homepage and follow the redirects, as any browser would. Nothing else is touched.
How to fix it
- Turn on HTTPS at your host. Most modern hosts, including the ones AI app builders publish to, issue a free certificate for you.
- Redirect every plain HTTP address to the same address on HTTPS with a permanent (301 or 308) redirect.
- Once HTTPS works everywhere, add a Strict-Transport-Security header so browsers stop trying HTTP at all.
Prefer us to do it? Ask for a fix quote
Common questions
Is HTTPS enough to make my app secure?
No. HTTPS protects data on its way between the browser and your server. It does nothing about leaked keys, open database tables or weak sign-in rules, which is why a survey runs many other checks too.
My site already shows a padlock. Why would this fail?
The padlock only tells you about the address you opened. If the plain http:// address still answers without redirecting, people who type your domain or follow old links can end up on the insecure version.