I have a new website and from day one, it was on HTTPS. For example:


Do I still need to redirect HTTP to HTTPS to avoid content duplication? For example, should I still set a redirect from http://www.example.com/ to https://www.example.com/?

  • 1
    Users should be redirected through the browser and searchers will never index the non-secure version. So, probably it won't be necessary. Nevertheless, I'll do it just in case. – Emirodgar Feb 5 '19 at 9:58
  • 3
    @Emirodgar A user won't be redirected through the browser unless a redirect has previously been put in place, so a redirect would be necessary? – MrWhite Feb 5 '19 at 16:54
  • @MrWhite indeed, I just assumed it was for all domains tutoref.com/…. Regards – Emirodgar Feb 6 '19 at 8:25
  • "site is only on https?" - What do you mean exactly by this? Is HTTP not accessible? – MrWhite Feb 7 '19 at 0:41

If search engines never crawled HTTP URLs under this domain, and if there are no HTTP links anywhere, you don’t need to redirect from HTTP to HTTPS for SEO purposes.

But you should still redirect for usability reasons:

  • If users manually enter URLs to your site, they often omit the https:// (e.g., starting with www.). Unless they visited your HTTPS site before, their browsers will likely request the HTTP variant.

  • If users enter the full URL, they might not notice the s in https:// and enter http://.

| improve this answer | |
  • Right, so if you are psychic or know the exact SEO algorithm, you can forgo the redirect? That is nonsense. – Keith Tysinger Feb 8 '19 at 3:27
  • @KeithTysinger: What do you mean? This has nothing to do with ranking, only with crawling/indexing. If a search engine never crawled/indexed a URL, this URL is obviously not part of the search engine’s index. And a URL that is not indexed doesn’t need to be redirected -- as far as search engines are concerned. – unor Feb 8 '19 at 9:19
  • Are you saying that Google does not penalize websites that are insecure? It goes way beyond "usability." It can be an SEO ranking factor and a huge blunder from a security standpoint. What if your bank's website only used http? It's not a usability issue it's a security issue. – Keith Tysinger Feb 9 '19 at 20:47
  • @KeithTysinger: This question is about a HTTPS-only site. Search engines can’t penalize a site that doesn’t exist (HTTPS only), or if it does exist, that they don’t know about (HTTP and HTTPS, but only HTTPS is indexed). – unor Feb 10 '19 at 10:35

If your site sends HSTS Preload headers and is listed in chrome's HSTS Preload list and all your users are using a browser that uses that list, then you can probably get away without using a redirect (assuming your domain doesn't respond on port 80 at all).

However if there's a chance that users might just type your domain in manually then you should really ensure that you redirect to HTTPS with a 301 permanent redirect.

| improve this answer | |

Best practices dictate that we should redirect non-secure traffic to https. One example: if you want to add a login script in the future, it must be secure. At that point, your visitors using http will be getting all sorts of error messages and warnings (mixed content, unsecured web form ...).

To avoid this kind of mess, just do the redirect.

| improve this answer | |

If it is from day one on HTTPS only, for me it means it should not even listen on port 80 for HTTP (trying to connect with pure HTTP should trigger a timeout error).

Only the HTTPS version should exist, and since you do not have an HTTP website in that case, there is nothing to redirect.

| improve this answer | |
  • 4
    AFAIK if a user types in a web address it only tries to connect via HTTP, so the website would just time out and never load. (HSTS is an exception) – Maximillian Laumeister Feb 6 '19 at 0:27
  • @MaximillianLaumeister Not necessarily, a browser could as well defaults on trying HTTPS if nothing is provided. And based on various announcements by Google and the like this seems to be clearly the direction... You can even do some kind of happy eyeballs algorithm like for the IPv4/IPv6 duality. See github.com/Rob--W/https-by-default and EFF HTTPS Everywhere project – Patrick Mevzek Feb 6 '19 at 0:36

Yes, if http:// and https:// version both are running at the same time.

No, if http:// visitors are already getting redirected to https:// then you don't have to redirect.

Run some tests and see if both websites are opening at the same time or not.

| improve this answer | |
  • 2
    What do you mean exactly by your second sentence: "If http:// visitors are already getting redirected to https:// then you don't have to redirect."? If HTTP is "already getting redirected" then presumably a redirect has already been implemented?! – MrWhite Feb 7 '19 at 0:43
  • Yup that's the same what I mean "If HTTP is "already getting redirected" then presumably a redirect has already been implemented and you don't have to do any redirects :) – Group Of Oceninfo Feb 7 '19 at 3:59
  • The point is, a redirect has been implemented under that scenario... so a redirect is required. Regardless of when or by whom. A redirect is a redirect. – MrWhite Feb 7 '19 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.