I am running a small static website in a google storage bucket.

I have http and https support.

But I want http to redirect to https, so no visitor ends up with the "not secure" browser warning.

There is no way to do that with a google storage bucket (yet?) so the easiest way is to set up a Cloudflare proxy in front of it.

But an equally simple solution would be to turn off http completely, so nothing listens on port 80.

What are the downsides of doing so ? In this day and age, any decent browser would attempt to connect to https directly, right ?

  • Most browsers still connect to HTTP by default, but I expect that to change within 5 years. Chrome is leading the pack and is the only browser right now that does HTTPS by default as far as I know. makeuseof.com/tag/google-https-chrome-default In Firefox you have to install plugins to get that functionality. I'm not sure if Microsoft Edge can do it at all. – Stephen Ostermiller Mar 25 '20 at 8:41
  • @StephenOstermiller "Chrome is leading the pack and is the only browser right now that does HTTPS by default" - It does?! If I type example.com in Chrome v80 (the latest), I end up at plain old http://example.com, not HTTPS, yet example.com is available over HTTPS. – DocRoot Mar 25 '20 at 12:37
  • Then I guess I'm wrong. I thought I'd read about that happening. – Stephen Ostermiller Mar 25 '20 at 12:47

In this day and age, HTTP is still the default protocol if the user types something into the address bar and doesn't specify a protocol at all. Most webmasters that want their users to only use HTTPS will leverage some redirect mechanism of the webserver, to receive the requested HTTP URL and convert it to HTTPS, then issue a redirect response to the user saying "got your request to access http://server.example/some/path?and=query, but this document has been moved to https://server.example/some/path?and=query". URL rewrite modules are a popular way to achieve this, but some servers may have a simple setting to push all HTTP requests to HTTPS. In other cases the application code of the site might do the redirecting

If you have full control of how the user gets these links then you can make sure that you only ever issue HTTPS links and the user is never aware that there is no HTTP version. For example if the user is using your website and you're listing files for download, you make sure the page they see only has HTTPS links on it; they'll never right click, copy, paste, remove the S, and try to access over HTTP (or if they do they shouldn't be surprised that it doesn't work)...

..but you probably do at least want a way for anyone typing your website into a browser to get to the main home page, to not have to type HTTPS as well, and for that purpose you use some kind of mechanism that will receive the request on HTTP and redirect to HTTPS

It's perfectly possible to run a website on any port, with any protocol. You can have just HTTPS on 443, or HTTP on 12380 and HTTPS on 55443. You could even have HTTPS on 80 and HTTP on 443; the browser doesn't look at the port number when deciding the protocol (it has some default ports built in that it infers from the protocol) but if you were to arrange such a weird situation then the users would have to type https://server.example:80 which would be quite confusing - make all this as easy as possible

As such, to answer the question, yes you can run just an HTTPS site, but you really should run an HTTP site to make it easy for anyone who might happen to type yoursite.example into a browser, press return and expect to reach your site. Once you have them you can send them links of any protocol and port and they'll just use them, but make that first onboarding step as easy as possible, probably by employing a redirect to HTTPS

  • 3
    There is HSTS Preloading, honoured by all major browsers to signal that a website should only be reached over HTTPS, without a single attempt on HTTP first. – Patrick Mevzek Mar 25 '20 at 7:34
  • "It's perfectly possible to run a website on any port, with any protocol." Yes, except that many networks heavily filter traffic, and would basically only let 80 and 443 go through (plus the DNS). Which means the website can listen on other ports... but may loose some visits. – Patrick Mevzek Mar 25 '20 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.