Force HTTPS sitewide and verify no HTTP pages exist

HTTPS enforcement addresses a fundamental vulnerability in how web traffic travels across networks — any data sent over plain HTTP passes across the network in readable, unencrypted form, meaning anyone positioned between the visitor and your server, whether on shared public WiFi, a compromised network device, or an internet service provider, can potentially read or even modify that traffic in transit.

The specific risk of allowing HTTP pages to coexist alongside HTTPS ones, rather than universally redirecting, is that any single unencrypted entry point undermines the security guarantee for the entire session — an attacker can potentially intercept the initial unencrypted request and inject malicious content or strip encryption from subsequent requests, a real, well-documented attack pattern that comprehensive HTTPS enforcement specifically closes off.

Browsers themselves increasingly treat unencrypted HTTP as actively untrustworthy, displaying explicit "not secure" warnings that erode visitor confidence regardless of your site's actual content — this reputational cost compounds the direct security risk, since visitors encountering this warning frequently abandon the page rather than proceeding.

Search engines also factor HTTPS status directly into ranking evaluation, treating comprehensive encryption as a baseline trust signal — sites with any remaining unencrypted pages face both this direct ranking impact and the compounding effect of the security and trust issues described above, making complete, sitewide enforcement the only configuration that fully addresses both the security and SEO dimensions of this check.