Redirecting bare domain to www doesn't when specifying http/https scheme

Question

I've recently uploaded a website on a domain via Firebase hosting. Using the domain registrar (NameCheap) I've also applied a 301 redirect rule (via NameCheap. It's called "URL redirect record" under the Host Records) so that going to "@" (for example example.com) will redirect to www.example.com.

However, I noticed that if I specify either http or https scheme like so - http[s]://example.com I get to https://example.com (even when entering http), and get an ERR_CONNECTION_REFUSED error.

What's the reason for that and how can it be fixed? Am I doing some things wrong?

I'll mention that at first the 301 rule did not work when I specified to go to https://www.example.com, and only after replacing the https with regular http did it work (although when visiting the site, I still see in the URL that it is in fact using https).

People have suggested HSTS (which is automatically added by Firebase) to be the cause for the issue, however, other websites (such as Facebook) have HSTS yet don't encounter the same problem.

Answer 1

Namecheap does not offer HTTPS for redirects. It would be better to implement the redirect at your hosting company so that they can do HTTPS for the redirect. This page has instructions about half way down for adding both www and no-www to Firebase and setting one to redirect to the other https://www.allwebtuts.com/add-a-custom-domain-on-google-firebase-hosting/

Redirecting http://example.com to either http://www.example.com or https://www.example.com should work fine. There are two reasons that you may be running into problems:

1. Browser caching: Browsers aggressively cache 301 redirects. If you change a 301 redirect you need to clear your browser cache before testing again. Alternatively test with a online or command line tool. I like using the command line: curl --head http://example.com/
2. HSTS: HSTS is a directive to bypass HTTP for secuity. It is a way of saying "my site will never ever use the insecure HTTP protocol". When HSTS is enabled, browsers automatically upgrade all HTTP URLs to HTTPS after visiting your site for the first time. So if HSTS is enabled, http://example.com will automatically get upgraded to https://example.com without hitting your server. When you are using Namecheaps redirects without HTTPS, users will just get the connection refused error.

Answer 2

The short answer is that your web hosting provider is not running an HTTPS server on the IP address associated with their webserver. (As indicated by ERR_CONNECTION_REFUSED ). I posit that if this is a default Namecheap setup that this is something they would need to rectify, but they may not be in a position to do so due to the substantial added complexity https adds to hosting a redirect service.

It also sounds like their may be a (browser) caching issue going on - which could explain the eratic behaviour you talk about in your last paragraph. Try flushing your browser cache or using an alternative browser.