What does the skill actually check?

It checks whether a web server redirects all HTTP traffic to HTTPS, rather than serving content over an unencrypted connection.

Does it fix a missing redirect?

No. It checks and reports on the server's redirect configuration; it does not change the server's settings.

Redirect HTTP to HTTPS

SkillDev tools

http-to-https is a skill for AI agents that checks whether a web server is configured to redirect all HTTP traffic to HTTPS. It is used when verifying that a server sends visitors who arrive over plain HTTP to the secure HTTPS version of a site instead of serving content over an unencrypted connection.

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

Have an AI agent that can load and use skills.

Then ask your AI: use the Redirect HTTP to HTTPS skill

What your AI can do with it

Check whether a web server redirects all HTTP traffic to HTTPS
Verify that HTTP requests are not served directly over an unencrypted connection
Report on a server's HTTP-to-HTTPS redirect configuration

Getting started

Have an AI agent that can load and use skills.
Add the http-to-https skill to the agent's available skills.
Ask the agent to check whether a web server redirects all HTTP traffic to HTTPS, giving it the server or site to check.

What this skill tells your AI

The instructions your AI receives, as published by thedaviddias/front-end-checklist in skills/http-to-https/SKILL.md and read by ahel’s review.

Without an HTTP-to-HTTPS redirect, users who type the domain without https:// or follow old links land on the insecure version of the site, exposing session cookies and form data to network attackers.

Quick Reference

Redirect http://example.com to https://example.com with HTTP 301 (permanent redirect)
Preserve the full path and query string in the redirect: https://$host$request_uri
Use 301 (not 302) so browsers and search engines cache the redirect and future requests go directly to HTTPS
Configure redirects at the server/CDN level — never rely on client-side JavaScript for security redirects
After validating HTTPS works, add HSTS to eliminate future HTTP requests entirely

Check

Test whether http://example.com redirects to https://example.com with a 301 status code. Check that the full URL path and query string are preserved in the redirect Location header.

Fix

Configure the web server to redirect all HTTP requests to HTTPS with a 301 status code, preserving the full request path. Verify the redirect with curl -I http://example.com.

Explain

Explain why redirecting HTTP to HTTPS is necessary, the difference between 301 and 302 redirects, and how HSTS can eliminate the redirect for returning users.

Code Review

Review server config, headers, forms, and integration points related to Redirect HTTP to HTTPS. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.

For full implementation details, code examples, and framework-specific guidance, see references/rule.md.

Rule page: https://frontendchecklist.io/en/rules/security/http-to-https

Signals

GitHub stars: 74k
Forks: 7k
Last commit: Oct 2026

Questions

When should this skill be used?: Use it when checking whether a web server is configured to redirect all HTTP traffic to HTTPS.
What does the skill actually check?: It checks whether a web server redirects all HTTP traffic to HTTPS, rather than serving content over an unencrypted connection.
Does it fix a missing redirect?: No. It checks and reports on the server's redirect configuration; it does not change the server's settings.

Advanced

Item type: skill
Key: http-to-https
Source: github.com/thedaviddias/front-end-checklist

github.com/thedaviddias/front-end-checklist