HTTP not redirected to HTTPS — fixing the plaintext entrypoint

Real-world risk

Users and links can stay on plaintext HTTP; cookies and tokens may leak on that first hop.

Fix steps (in order)

1. On port 80, return 301 or 308 to the canonical https:// URL for all paths you care about.
2. Example nginx: return 301 https://$host$request_uri;

Example configurations

Patterns for common stacks. Set headers at your CDN, load balancer, or origin as appropriate.

• nginx (HTTP → HTTPS) · nginx

  server {
    listen 80;
    return 301 https://$host$request_uri;
  }

• Express · typescript

  app.use((req, res, next) => {
    if (req.secure) return next();
    res.redirect(301, "https://" + req.headers.host + req.url);
  });

• Apache · apache

  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]