Deliver the document over HTTPS

What does this finding mean?

The report identifies this check as not-https in Freshness and hygiene. The category carries up to 10 of the 100 rubric points. This is a category weight, not an automatic deduction for this finding. Read the scan detail for the measured state, overlapping signals and any score cap.

Enable valid HTTPS and redirect the HTTP route to the same public path over HTTPS.

Why does this matter for AI retrieval?

Canonical URLs and valid dates describe which document this is and when it changed. HTTPS protects delivery. These are observable document signals, not a measurement of how often ChatGPT, Claude, Perplexity or Gemini visits.

How do I check and resolve it?

1. Check the certificate and origin HTTPS configuration. Fix certificate errors before redirecting visitors.
2. Redirect HTTP to the equivalent HTTPS path, preserving useful query parameters. Avoid redirect loops between the CDN and origin.
3. Update internal links, canonicals and sitemap URLs to HTTPS. Verify assets also load over HTTPS.

Adapt the example to the reported issue and the actual route. Placeholder names, URLs and dates must be replaced with facts from your site.

Copy code

curl -I 'http://example.com/guide/'
curl -I 'https://example.com/guide/'
# HTTP should redirect to the intended HTTPS canonical URL.
# HTTPS should deliver the public document with a valid certificate.

Verify the result

Follow the HTTP redirect and confirm it ends at a usable HTTPS page. Check the canonical and rescan the HTTPS URL.

Open the related tool or technical guide, then run a new scan of the affected URL. Keep unknown checks marked unknown until you have a complete response.

Copy a prompt for your coding agent

Paste this into Codex, Claude Code or Cursor from your own repository. Include the scan's exact URL and detail so the agent can verify the observation.

Copy prompt for coding agent

Investigate the scanner finding "Deliver the document over HTTPS" (not-https) in this repository.
Observation: The scanned URL uses HTTP.
Required change: Enable valid HTTPS and redirect the HTTP route to the same public path over HTTPS.
Inspect the existing route, shared layouts and configuration first. Confirm the finding against the actual response before editing. Preserve intentional access restrictions, existing content and unrelated changes. Use only factual identity and date values. Make the smallest appropriate fix, verify the deployed HTML or resource response and run the relevant project checks. Explain any measurement that remains unknown. Do not promise search rankings or AI citations.
Reference: https://letthebots.in/fixes/not-https/