Is there a way to force an SSL lock without using a 301 redirect, such as server side?

I'm happy to supply context if requested.

  • Redirects are sent server side. They require cooperation from the client to use them, but there isn't going to be a method that works without involving the client somehow. May 23, 2019 at 15:24
  • 2
    You could potentially detect HTTPS (or absence of) with JavaScript and "redirect" from the client? It's not a "301 redirect", however, it's not particularly secure. (?)
    – DocRoot
    May 24, 2019 at 9:07

1 Answer 1


It's unclear to me what your use case is, but here is a solution to your question as it's worded. You can use HSTS preloading to ensure that all modern browsers always connect using HTTPS, without the need for a 301 redirect (though keeping a 301 redirect active is recommended).

Note that to be eligible for HSTS preload list inclusion, you must do one of the following:

  1. Set up a redirect from HTTP (port 80) to HTTPS, or

  2. Refuse all HTTP (port 80) connections

Once your site is submitted, it will take a few months for the list to be published to web browsers. Then, browsers will ONLY connect to your site via HTTPS. Removal from the HSTS preload list (and removal of HSTS in general) is messy and takes a long time, so be absolutely sure that this is the solution for you before you implement it.

  • 2
    Or buy a .dev domain because the entire top level domain is already on the HSTS preload list. May 23, 2019 at 17:53
  • There are many other TLDs on the preload list, or at least Google ones: .APP, .PAGE or others: .BANK, .INSURANCE. Jun 3, 2019 at 23:28
  • "Note that to be eligible for HSTS preload list inclusion, you must do one of the following:" Based on hstspreload.org there are some more conditions: having a valid certificate (which is kind of implied when doing WebPKI) but also provide an strict-transport-security header with some constraints on values allowed. Jun 3, 2019 at 23:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.