Does your site serve secure working responses?
It checks HTTPS, the plain-HTTP route and certificate validity.
What Check Engine measures
A site not served over HTTPS produces a critical finding and ends this check. Otherwise the plain-HTTP probe is reviewed unless skipped by policy. Refusals, zero statuses and server errors produce uncertainty rather than a definite redirect fault. Other client errors and nonredirecting responses have separate cases. Certificate validity is checked separately. Expiry below 21 days is reported, with high severity below 7 days and medium otherwise. For example, a certificate with exactly 7 days left stays in the medium expiry group.
Site-level scheme and saved redirect-probe results are combined with a certificate check against the final origin. The final origin is used for the certificate host, avoiding an assumption that the starting address remained the destination.
How to read the result
Missing HTTPS and invalid certificates are critical. Redirect problems can be high or medium, unknown results notices, and expiry high or medium. A certificate test that cannot run is not silently treated as valid or invalid.
Why it matters
Secure delivery and a consistent plain-HTTP route are different configuration tasks. Keeping uncertainty separate helps avoid changing a correct redirect because a network refusal prevented this particular audit from observing it.
How to fix it
Use a valid certificate for the final host and review its renewal setup. Redirect the intended plain-HTTP routes to their secure equivalents where appropriate. Investigate probe failures before declaring the route broken. Test the affected host and path after changes, checking both the response destination and certificate rather than only the browser's final appearance.
How to redirect http:// to https://
What we found in field audits
Problems in Security & trust were found on 14 of the 14 sites we audited. These are area totals. Read the field-audit method.
Method note
backend/seo_engine/checks/security.py, https, revision 0bb8e8d3.
Common questions
How soon before certificate expiry does the HTTPS check report a finding?
It reports fewer than 21 days remaining. Expiry with fewer than 7 days left is high, with the remaining reported window medium.
Is a certificate with seven days left in the high-expiry group?
No. Exactly 7 days remaining stays medium. The high group requires less time than that.
Does an unavailable certificate probe mean the certificate is invalid?
No. The report calls unknown results notices. An uncompleted test does not establish validity or invalidity.