Checks

HTTP does not redirect to HTTPS

The HTTP endpoint responded without a redirect whose Location starts with https://.

Why it matters

Visitors who type the bare host, or who follow an old http:// link, stay on plaintext HTTP.

What to do

Return a permanent redirect from HTTP to the canonical HTTPS URL.

Reference

HTTPS availability and redirect behavior are baseline transport security controls.

OWASP Transport Layer Security Cheat Sheet