Force HTTPS and enable HSTS — Windsurf

Using a different tool? Pick your stack:

The prompt for Windsurf

Copy and paste this into your Windsurf chat exactly as-is.

Using Windsurf Cascade, apply these edits across the project in one pass:

Force HTTPS

1. Configure your hosting provider to issue a Let's Encrypt certificate (most platforms do this automatically).
2. Add a permanent (301) redirect from http:// to https://.
3. Set the Strict-Transport-Security header so browsers refuse plain HTTP.

Why this matters

Common mistakes to avoid

• error_outlineEnabling HSTS before all subdomains serve HTTPS — browsers then refuse non-HTTPS subdomains.
• error_outlineSetting `Strict-Transport-Security: max-age=300` for "safety" — short max-age defeats the point.
• error_outlineRedirecting HTTP to HTTPS via a 302 instead of a 301 — SEO equity leaks.
• error_outlineRedirecting to a specific HTTPS path and losing the original query string.

How to verify the fix worked

• check_circleVisit `http://yoursite.com` — browser must redirect to HTTPS automatically.
• check_circle`curl -I http://yoursite.com` — returns `301 Moved Permanently` with an HTTPS Location header.
• check_circle`curl -I https://yoursite.com` — response includes `Strict-Transport-Security: max-age=31536000; includeSubDomains`.
• check_circleRun SSL Labs test at https://www.ssllabs.com/ssltest/ — grade A or A+.

Frequently asked questions