HTTPS Redirect and HSTS Setup: Server Configuration

Imagine: your site runs on HTTPS, but some links lead to HTTP, and the browser blocks loading. Or the search engine indexes both versions, diluting PageRank. An incorrect redirect kills SEO and user trust. Each lost customer due to mixed content costs the business an average of $1000. Our task is to set up a unified HTTPS version with HSTS to eliminate traffic leaks and downgrade attacks. With proper configuration, SEO traffic can grow up to 15%, and load time can decrease by 30% by eliminating unnecessary redirects. We have been doing this for over 10 years, completing over 40 projects for HTTPS migration.

Why One Redirect Is Not Enough?

Redirecting from HTTP to HTTPS is only the first step. Without HSTS, the browser does not remember the requirement, so on the next visit it makes another HTTP request, potentially vulnerable to man-in-the-middle attacks. Additionally, a chain of multiple redirects (e.g., http → https://www → https:// without www) increases load time by 1–2 seconds and negatively affects Core Web Vitals. In practice, each additional redirect adds 50–100 ms to TTFB. The optimal scheme: a single 301 redirect from HTTP to HTTPS (with or without www) and an immediate HSTS header.

Problems Solved by Proper Redirect

• Mixed content: When an HTTPS page loads scripts or styles via HTTP. The browser blocks them, breaking functionality. We check all resources and fix the protocol.
• Downgrade attacks: An attacker intercepts the HTTP request and replaces the content. HSTS with preload completely eliminates this vector.
• SEO losses: Duplicate indexing, incorrect redirects, loss of link equity. We set up canonical URLs and correct status codes.

How We Do It: Stack and Configs

We use proven stacks: Nginx + Laravel, Apache + WordPress, Cloudflare. Here are configurations for each case.

Nginx: Redirect HTTP → HTTPS

# Redirect all HTTP traffic server { listen 80; listen [::]:80; server_name example.ru www.example.ru; location /.well-known/acme-challenge/ { root /var/www/certbot; } location / { return 301 https://example.ru$request_uri; } } # Redirect www to non-www (or vice versa) + HTTPS server { listen 443 ssl; server_name www.example.ru; ssl_certificate /etc/letsencrypt/live/example.ru/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.ru/privkey.pem; return 301 https://example.ru$request_uri; } # Main server server { listen 443 ssl http2; server_name example.ru; # ... } 

Add HSTS to the main server:

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; 

Laravel: Enforce HTTPS in Application

// AppServiceProvider + bootstrap/app.php public function boot(): void { if (app()->environment('production')) { URL::forceScheme('https'); } } ->withMiddleware(function (Middleware $middleware) { $middleware->trustProxies( headers: Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO, proxies: '*' ); }) 

Without trustProxies, Laravel does not see that the request came via HTTPS (Nginx → PHP over HTTP) and generates HTTP links. This is a common mistake that can cost weeks of indexing.

Apache: .htaccess

<IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L] </IfModule> Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" 

Cloudflare

In the Cloudflare panel: SSL/TLS → Edge Certificates:

• Always Use HTTPS → enable
• HSTS → enable, max-age 12 months

Verification of Correct Redirect

Use curl with flags -I and -IL:

curl -I https://example.ru | grep -i strict curl -IL http://www.example.ru 

It should return the header Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. You should expect no more than one 301 redirect (with www to non-www and HTTP to HTTPS). If there are more redirects or an error, the chain is not optimized.

How to Fix Mixed Content?

After setting up the redirect, check the browser console for blocked items. Use Screaming Frog to scan—it will find all resources loaded over HTTP. We replace the protocol in the database or use Content-Security-Policy: upgrade-insecure-requests. The latter forces the browser to automatically upgrade HTTP requests to HTTPS. On one project, this reduced manual fixing time from 8 hours to 10 minutes.

Comparison of Configurations for Different Servers

Nginx processes redirects faster: up to 30% less overhead compared to Apache mod_rewrite.

Checklist: What to Check After Setup

What's Included in the Setup

• Audit of current configuration: check redirects, HSTS, mixed content
• Server setup (Nginx/Apache) or Cloudflare
• Adding HSTS with max-age and preload configuration
• Fixing mixed content in code and database
• Verification of redirect chain and SEO metrics
• Documentation of work performed
• 30-day support guarantee after deployment

Process: From Audit to Deployment

1. Analytics: check current redirects, HSTS, mixed content, SEO metrics.
2. Design: choose scheme (www vs non-www, subdomains), plan the chain.
3. Implementation: configure server configs, add HSTS, update application.
4. Testing: curl, browser console, SEO tools (Screaming Frog).
5. Deployment: roll out to production with gradual increase of HSTS max-age.

Timeline

• Basic Nginx/Apache setup with HSTS: from 1 hour.
• Comprehensive setup with Laravel, Cloudflare, and mixed content fix: from 4 hours.
• Cost is calculated individually. Engineers evaluate the project for free.

Contact us—we will conduct an audit and prepare a configuration. Get your setup ordered today and receive a free consultation. We are ready to help.

According to MDN HSTS documentation