Site also on http

Why it matters

What a visitor fills in on an http page, such as a contact form or a login, travels readable over the network. Browsers mark the page Not secure, and many visitors leave. Google prefers the https version.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It requests the homepage over http and follows the redirects. If the visit does not end on https, or the server does not answer on http at all, it is reported.

Common causes

• No redirect from http to https at the host
• A redirect rule that was lost when moving to another host
• A redirect that only works for the address with www, or only without

How to fix it

1. Switch on the redirect from http to https at the host. At most hosts that is one switch.
2. No switch? Add a 301 redirect in .htaccess or in the server settings.
3. Test both the address with and without www.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Your site can also be visited without encryption". When everything is in order, the report says: "Every visit goes to the secure https version".