HTTPS is enforced

Serving over HTTP exposes every request to network-level eavesdropping and man-in-the-middle attacks — credentials, session cookies, and form data transit in plaintext. OWASP A02 (Cryptographic Failures) and NIST SP 800-53 SC-8 both cite unencrypted transport as a baseline failure. Beyond confidentiality, modern browsers mark HTTP pages as 'Not Secure', and Google penalizes them in search rankings. Sites that accept HTTP alongside HTTPS without redirecting give attackers a trivial downgrade path: intercept a single HTTP request, strip the redirect, and own the session. CWE-319 directly captures this: cleartext transmission of sensitive information.

Configure your server to redirect all HTTP traffic to HTTPS with a 301. On nginx, add this to the HTTP server block:

server {
  listen 80;
  server_name example.com;
  return 301 https://$host$request_uri;
}

On Vercel, Netlify, and Cloudflare Pages, HTTPS redirect is enforced automatically at the edge — no config needed. For Apache, add to .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Verify the redirect is active with curl -sI http://yoursite.com | grep -i location.