Risk: Medium 5.9 Medium CWE-319: Cleartext Transmission of Sensitive Information

Missing HTTP to HTTPS Redirect: Preventing Cleartext Traffic Interception

The HTTP protocol transmits network packets without encryption. If a site is accessible via HTTP without an immediate 301 redirect to HTTPS, data travels in cleartext.

Attackers on public Wi-Fi networks can intercept unencrypted session cookies, passwords, and inject malicious scripts into web pages (Man-in-the-Middle attacks).

Vulnerability Risk & Threat Impact

Cleartext interception of authentication credentials and degraded search engine rankings across Google and Yandex.

Attack Vector: Automated botnets continuously harvest public endpoints matching this signature. Once discovered, exploitation is triggered automatically without human review.

How Our Scanner Inspects for This Flaw

Site Check queries port 80 over HTTP and confirms whether an immediate permanent redirect (301 Moved Permanently) to HTTPS is enforced.

Diagnostics of transport security and HTTP response policies parse security headers returned by the origin server. The scanner checks for Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and robust cookie protection attributes (HttpOnly, Secure, SameSite).

Remediation Guide (Step-by-Step Fix)

To resolve this vulnerability, apply the following configuration or code snippet to your web server:

Enforcing permanent 301 HTTPS redirect in Nginx

      # Force permanent 301 redirection from HTTP to HTTPS in Nginx:
server {
    listen 80;
    server_name your-domain.com www.your-domain.com;
    return 301 https://$host$request_uri;
}

Configure a permanent 301 redirect from HTTP to HTTPS for all domains and subdomains.
Enable HSTS (Strict-Transport-Security) to prevent protocol downgrade attacks.

Attack Anatomy & Real-World Business Impact

Plaintext HTTP endpoints enable Man-in-the-Middle (MitM) eavesdropping and SSL-stripping attacks on shared networks, exposing session cookies and authentication payloads.

Financial & Legal Liability Risks: Exploitation of the http to https redirect attack vector enables unauthorized perimeter traversal, exposure of sensitive telemetry, and compromise of user sessions.

Compliance Framework Impact: Violation of fundamental security controls specified in OWASP Top 10 (A05:2021 Security Misconfiguration), SOC 2 Type II trust criteria, and ISO 27001 Annex A.

Defense-in-Depth Engineering Matrix

Defense Layer	Technical Action	Tool / Enforcement
Edge Perimeter & Ingress Gateway	Enforce granular path restrictions and deny rules for routes matching http-to-https-redirect	Nginx Ingress Directives
Application Runtime Hardening	Disable verbose runtime telemetry and enforce least privilege controls for http-to-https-redirect	Runtime Configuration Hardening
CI/CD DevSecOps Automation	Incorporate automated verification gates for http-to-https-redirect within continuous deployment pipelines	Site Check Security Scanner

CLI Remediation Verification: Terminal Commands

After applying configuration changes or patching source code, verify that the exposure is neutralized using command-line diagnostic tools:

Bash / cURL: Diagnostic Endpoint Verification

curl -I -s http://your-domain.com/ | grep "Location:"
# Must return a 301 redirect to https://

DevSecOps Best Practices & CI/CD Hardening

Implement port 80 return 301 https://$host$request_uri; rules in Nginx and configure HSTS with preload directives.

Frequently Asked Remediation Questions

How rapidly do malicious botnets probe for http to https redirect?

Automated internet-wide port scanners and crawlers identify exposed public endpoints within hours of DNS propagation.

Does resolving http to https redirect mandate infrastructure downtime?

No. Most web server rule adjustments and configuration updates take effect instantly via zero-downtime service reloads.

Application Security Lead Auditor Assessment

Properly configured security headers establish browser-enforced defense-in-depth for all visitors. The absence of modern CSP and HSTS leaves client sessions susceptible to Clickjacking, protocol downgrade eavesdropping, and MIME-type confusion attacks.

To permanently close the «Missing HTTP to HTTPS Redirect: Preventing Cleartext Traffic Interception» threat vector, integrate verification gates into your CI/CD pipeline and maintain automated perimeter checks with Site Check.