HTTPS Redirect Checker – Inspect HTTP to HTTPS Redirect Chains

The HTTPS Redirect Checker traces the entire HTTP-to-HTTPS redirection path for any domain or URL. It verifies whether unencrypted HTTP requests are automatically, permanently (HTTP 301), and securely upgraded to encrypted HTTPS.

It audits intermediate redirect hops, flags temporary redirects (302/307) that harm SEO and security, detects mixed-content redirect loops, and verifies HSTS header presence to protect against SSL stripping attacks.

Even if a website implements a 301 redirect from HTTP to HTTPS, the initial request on port 80 is unencrypted. A man-in-the-middle attacker (such as on public Wi-Fi) can intercept this initial request and execute an SSL stripping attack (using tools like sslstrip), maintaining an unencrypted HTTP connection with the user while proxying HTTPS to the server.

HTTP Strict Transport Security (HSTS, RFC 6797) instructs browsers to never make unencrypted HTTP requests to the domain. By submitting the domain to the HSTS Preload list (included directly in Chrome, Firefox, Safari, and Edge binaries), the browser enforces HTTPS even on the very first request, completely eliminating the window for SSL stripping.