Redirect downgrades HTTPS to HTTP

CriticalDeveloper fixSecurityPer-page checkredirect_https_downgrade

What this means

A hop in this redirect path moves from an https:// address to an http:// one, dropping the visitor out of TLS. Browsers mark the destination as not secure, the request is exposed to interception, and HTTPS ranking benefit is lost.

How to fix it

Fix the redirect target to use https://. Redirects should only ever go http → https, never the reverse, and the site should send HSTS to stop the downgrade at the browser.

Fix effort

This check needs a developer fix: it turns on a routing, hosting or infrastructure decision that no automatic edit can make safely.

Authoritative source

https://developers.google.com/search/docs/crawling-indexing/https

Related checks

More in Security

Mixed content on an HTTPS page Content-Security-Policy is report-only Missing Content-Security-Policy header Missing HSTS header Page not served over HTTPS All checks

Find every page this affects

CrawlX runs this check — and 161 others — across your whole site, ranks the findings by estimated impact, and opens the fixable ones as pull requests. Free for 500 URLs.

Start crawling free Browse all checks