Your site redirects to HTTPS. Are you sure?

You typed your domain, you saw a padlock, you moved on. Reasonable. But the padlock only tells you that this request ended up on HTTPS. It says nothing about the other three ways people reach your site.

The four doors

There are four ways to ask for your homepage: http and https, each with and without www. All four should end up in the same place. Often one of them does not.

A missing redirect on one variant means search engines can see two versions of every page. Your links get split between them, and neither version gets the credit.

Mixed content

Even a correctly redirecting site can load an image or a script over plain HTTP. Browsers block the active ones outright — which can break your page — and warn on the rest, which quietly removes the padlock the customer was looking for.