HTTP redirects to HTTPS (temporary)
HTTP redirects to HTTPS with 302, 303, or 307.
Why it matters
A temporary status is less likely to be cached, so clients keep requesting HTTP.
What to do
Use a permanent 301 or 308 redirect to the HTTPS URL.
Reference
HTTPS availability and redirect behavior are baseline transport security controls.