DISC-028Find
Served over HTTPS
Checks that your homepage is served over HTTPS and that http:// redirects to https://.
What we check
We take the final URL of your homepage, after any redirects. If it is https, we request http://<your host>/ and follow its redirects to see where it ends up. If the scan itself started on http:// and was redirected to https://, we use that redirect and send nothing more.
Why it matters
UCP requires the service endpoints a profile declares to be https URLs. UCP Checker fetches a store's UCP profile over HTTPS only, refuses a redirect to http, and lists HTTPS among its Discovery checks.
How we check
PASS: the homepage ends on https and http:// redirects to https. Also PASS when nothing answers on http:// at all (a connection error or timeout); the result says so. WARN (score 50): the homepage is https but http:// answers with a 2xx page and no redirect. FAIL: the homepage itself ends on http. SKIPPED: your store has no public domain (localhost or an IP address), the crawl captured no homepage, or the http:// answer could not tell us anything (our request budget was spent, robots.txt kept us out, the redirect left your site or looped, a bot wall answered, or an error status came back with no redirect).
How to fix it
- Serve the store on https:// with a valid certificate.
- Redirect every http:// request to the same https:// URL with a 301, at your CDN or host.
What good looks like
GET http://shop.example/ 301 Location: https://shop.example/ GET https://shop.example/ 200
Sources
Could an agent buy from your store?
The free scan runs all 51 checks on your store in about five minutes.
Scan my store