ShipPatrolScan your site for legal, security and SEO gaps, then fix them
SecurityUsually high

HTTPS redirect checker: does http:// send visitors to https://?

Your site has a certificate. The question is whether someone typing your address without https:// ends up on the secure version. ShipPatrol checks the plain http:// address.

Why it matters

If the http:// version of your site loads without redirecting, visitors on public Wi-Fi can be served a tampered page, and logins or form data can be read in transit. Browsers also mark http pages as "Not secure".

How Patch checks

We request http://{host}/ without following redirects and check that it answers with a permanent redirect to https://.

How to fix it

  1. Turn on "Always use HTTPS" (or "Force HTTPS") in your host or CDN settings.
  2. Make sure http://your site/ returns a 301 or 308 redirect to https://your site/.
  3. Then add an HSTS header so browsers skip the http step entirely.

Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.

Where this applies

Good security practice everywhere.

Free scan

Check this on your site.

Patch runs "HTTPS is not enforced" along with every other check, from the UK, the EU and the US. Free, no signup.

No signup needed. Not legal advice; every check names its source.

All checks