Site Not Served Over HTTPS: What It Means and How to Fix It

What this finding actually means

HTTPS is HTTP with encryption layered on top, using a TLS certificate to scramble the connection between a visitor's browser and your server. When a page loads over plain HTTP instead, everything sent back and forth (passwords, contact form details, session cookies for your admin area) moves as readable text that anyone sharing the network, such as public Wi-Fi or an internet provider, can see (Cloudflare, What is HTTPS?).

This finding fires in one of two ways. Either your site has no certificate at all and answers on http://, or it does have a certificate but still lets people reach the plain http:// version because there is no rule sending them to the secure one. From the outside view, BadgerScan simply requested your pages and saw an unencrypted response served, or an http:// URL that was never redirected.

In short, having a certificate is only half the job. HTTPS is not truly enforced until every http:// request is automatically sent to https://.

Why it is worth fixing

Encryption protects the moments that matter most: someone logging into your store, a customer submitting a form, or you signing into your own dashboard. Without it, those details can be quietly read in transit, and that is the kind of exposure worth closing calmly and promptly.

There is a visible cost too. Modern browsers label plain HTTP pages as 'Not secure' in the address bar, which erodes trust, and search engines favor secure sites. Fixing this improves both safety and how your business looks to visitors.

How to fix it, step by step

The goal is a certificate installed, every request forced to HTTPS with a permanent redirect, and a header that tells browsers to stay secure. Most hosts make the first part a one-click job, and certificates are free.

• Get a TLS certificate. Check your hosting control panel first, since most hosts offer a free certificate you can enable with one click. If yours does not, Let's Encrypt, Getting Started issues them at no cost.
• Confirm the secure version loads. Visit https://yourdomain.com directly and check that the padlock appears with no certificate warnings before you force any redirects.
• Redirect all HTTP to HTTPS with a 301 (permanent) redirect at your web server or CDN. Many hosts and CDNs have a single 'Always Use HTTPS' or 'Force HTTPS' toggle that does this for you.
• If you run WordPress, go to Settings then General and set both the WordPress Address (URL) and Site Address (URL) to the https:// version so the site stops linking to its own insecure pages.
• Once HTTPS is enforced everywhere, add an HSTS response header so browsers refuse to downgrade, starting with a value like Strict-Transport-Security: max-age=31536000; includeSubDomains.

One thing to check before you finish

Only add the HSTS header after HTTPS works flawlessly on every part of your site, including any subdomains you name in includeSubDomains. HSTS tells browsers to remember the rule, so if a section is still broken over HTTPS when you switch it on, visitors can be locked out until it is fixed and the remembered policy expires.

To verify, load a few key pages over http:// and confirm each one lands on https://, then check for 'mixed content' warnings caused by images or scripts still pointing at http://. You can re-run the free scan or use the security headers checker to confirm the redirect and HSTS header are both in place.