Module 4 · 4.1

English

Nederlands English Deutsch

https and a proper redirect

Module 4: Speed, mobile and https · Reading time: 11 minutes

Learning objective: After this lesson you can explain why https matters for search engines and visitors, name the difference between a permanent and a temporary redirect, and check that every variant of your address ends up on the same https page in one step.

Key concepts: https, certificate, redirect, 301 and 308 (permanent), 302 and 307 (temporary), redirect chain, preferred address, www or without www, HSTS, mixed content

Four addresses for one homepage

When you type a website's name into the address bar, your browser can end up in four places:

Variant	Example
http without www	`http://example.com/`
http with www	`http://www.example.com/`
https without www	`https://example.com/`
https with www	`https://www.example.com/`

To you, that is one site. To a search engine, they are four different addresses. If all four show the same page, Google has to decide for itself which one is the "real" address. Google calls this the canonical address (lesson 3.5 goes into this in more depth). Google recommends choosing one address yourself as your preferred address and redirecting the other variants to it. Then there is no doubt, and links to any variant count towards the same page.

Bloemenatelier Lotte, a florist in Amersfoort, chooses https://www.example.com/. The other three variants redirect there. Whether you go with or without www makes no difference to search engines. What matters is that you make one choice and stick to it everywhere: in your menu, your sitemap, your canonical and your business profile.

Why https

https means the connection between browser and server is encrypted with a certificate. Nobody along the way can read along or change anything on the page, for example on public wifi.

For search engines, https counts in two ways:

As a signal. In 2014 Google announced that https is a ranking signal, but called it "a very lightweight signal" that carries less weight than good content. In the documentation on page experience, https is listed as one of the questions to ask yourself ("are your pages served securely?"). So don't overstate it: https alone won't get you to the top.
For visitors. Browsers show "Not secure" next to a page on http, especially one with a form. A visitor who sees that is more likely to leave. You notice that in your traffic, not in a ranking rule.

A valid certificate is available for free these days through Let's Encrypt. With most hosting companies, including WebOké, it is requested and renewed automatically. Make sure the certificate covers both names: without and with www. If it only covers example.com, then https://www.example.com/ gives a certificate error, before the redirect can even happen.

Permanent or temporary redirect

A redirect is a response from the server saying: "this page is somewhere else". It uses a three-digit status code starting with 3, plus a Location header with the new address.

Code	Meaning	What Google does with it
301	Moved permanently	Strong signal that the target is the canonical address
308	Moved permanently (method stays the same)	Same as 301
302	Found (temporary)	No signal; the old address often stays in the results
307	Temporary (method stays the same)	Same as 302

According to Google Search Central, indexing uses a permanent redirect as a signal that the target should become canonical. A temporary redirect doesn't do that: the old address usually stays in the results. Moving from http to https and choosing www or without www are lasting decisions. So use 301 or 308.

You can see a redirect for yourself. In a terminal:

$ curl -sI http://example.com/
HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/

Or in your browser: open the developer tools (F12), go to the Network tab, turn on the option that preserves the log when a new page loads, and load the http address. You will then see every step with its code.

Redirect chains

A redirect chain is a redirect to an address that redirects again itself. A common example:

http://example.com/        301 → https://example.com/
https://example.com/       301 → https://www.example.com/
https://www.example.com/   200

That works, but it costs an extra round trip to the server on every first visit. web.dev lists redirects as one of the causes of a slow first server response (lesson 4.3): every step adds up, and chains even more so. It's better for every variant to reach the preferred address in one step:

http://example.com/          301 → https://www.example.com/
http://www.example.com/      301 → https://www.example.com/
https://example.com/         301 → https://www.example.com/
https://www.example.com/     200

For the old http address with the other name, one step isn't always possible, because with some settings the server first sends you to https on the same name and only then to the other name. Two steps is acceptable in that case; three or more is a reason to check your settings. A loop (A redirects to B, B redirects back to A) is always wrong: the page then won't open at all.

HSTS: the browser remembers

HSTS (HTTP Strict Transport Security, RFC 6797) is a header the server sends along over https:

Strict-Transport-Security: max-age=31536000

Once a browser has seen this, it goes straight to https for this site from then on, without trying http first. That saves the first redirect and protects against eavesdroppers. web.dev also mentions HSTS as a way to avoid the redirect from http to https. For search engines, HSTS is not a signal; for your visitors, it is an improvement. Only turn it on once https works properly on all names, because the browser remembers it for as long as max-age says. The Safe online course goes into this further.

Mixed content

An https page that loads an image, script or stylesheet via http:// has mixed content. Browsers block insecure scripts and stylesheets, or show a warning. After switching to https, you often see this with old images in text or with a theme that uses fixed addresses. Search the source code for src="http:// and href="http:// and replace them with https or with a relative address.

In practice: setting up the redirect to https

With a WebOké hosting package, you turn on the redirect to https in DirectAdmin in the domain settings (switch "Force SSL with https redirect"), and on the same page under "Force redirect" you choose whether you work with or without www. Use one place for the redirect: two rules that each do something different (for example in the panel and in a plugin) can easily cause a loop. A site made with the AI Builder gets a certificate and its own address when you publish it. In WordPress, go to Settings, General and enter the WordPress Address and Site Address with https:// and your chosen name; the redirect itself is handled on the server. Other providers and website builders work in a similar way, only the buttons have different names.

If you want to do it via .htaccess (Apache or LiteSpeed), this sends all variants to https://www.example.com in one step:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L]

Afterwards, always check all four variants, also with a path added (http://example.com/contact): the path must be kept, not jump to the homepage.

Summary

Choose one preferred address (https, with or without www) and redirect the other variants to it.
Use 301 or 308 for lasting redirects; 302 and 307 are temporary and give Google no signal about the canonical address.
Make every variant reach the preferred address in one step, two at most; chains cost time and loops break the site.
According to Google, https is a lightweight ranking signal; for visitors it is mainly a matter of trust. The certificate must cover both names.
HSTS makes the browser go to https by itself; clean up mixed content after the switch.

Quiz

Exercise

Exercise A4.1: Does everything go to https in one step? Enter your domain name (without www). The program tries all four variants (http and https, with and without www), follows every redirect step by step and checks the certificate for both names. For each variant you see the chain with status codes, whether they all end up on the same https address, and whether there is an HSTS header. No site of your own? Use rijksoverheid.nl.

Cookies at WebOké

Cookie settings

Necessary

Marketing