Engineering Glossary · Transport Security
HTTPS: The Redirect Chain Is Costing You a Round Trip
Typing the bare domain and landing on the canonical URL four hops later costs a mobile visitor most of a second before a single byte of HTML arrives.
The short answer
HTTPS is ordinary HTTP travelling inside an encrypted connection — the web's standard transport, keeping browser-to-server traffic unreadable and unaltered in flight.
In practice it is also a performance gate rather than only a security one, because HTTP/2 and HTTP/3 are only offered over TLS. The catch is what people leave behind after a migration: http to https, then non-www to www, then a trailing slash, each a full round trip. Collapse that chain to a single redirect and you recover more time than most caching plugins will ever give you.
By the HostingFast team · Reviewed 12 August 2026
0
Jargon left undefined
100+
Entries, all cross-linked
Real
Working examples
Free
To read, always
The certificate makes it possible; TLS does the work. Browsers now treat plain HTTP as the exception — they flag it, they withhold features reserved for secure pages, and they try the secure address first when you type a domain.
Migrating a site is a well-trodden routine. Install the certificate, update the site URLs, add 301 redirects, then hunt down any mixed content still loading over HTTP. HSTS can then pin browsers to the secure version permanently.
Count the hops before anything else
curl -sIL http://example.com and read every Location header that comes back. Each one is a request, a response and — on the first hop — a fresh connection. A chain of http to https to www to a trailing slash is three round trips a visitor pays before your server has been asked for any content at all, and on a mobile connection that is a measurable fraction of a second.
The repair is a single rule that lands on the canonical URL in one move, rather than three rules stacked by three different people over three years. Then run the same curl again and confirm you see one 301 and then a 200. That is the entire test.
Mixed content is a correctness bug with a performance tail
One asset still referenced over http:// is either blocked outright or upgraded by the browser, and either outcome is worse than a clean reference. Blocked means a missing stylesheet or a dead script; upgraded means an extra negotiation for something that could have been requested correctly the first time.
Find them in the browser console, which names each offending URL, then fix them at source rather than with a plugin that rewrites output on every request. On WordPress, wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run shows you the scale before you commit, and running it for real puts the correction in the database where it costs nothing to serve.
HSTS: what it buys and what it locks in
The Strict-Transport-Security header tells a browser to go straight to HTTPS for your domain without asking, which removes the initial insecure hop for every repeat visitor. That is a genuine saving and it also closes a real attack window on the first request.
It is also a commitment. max-age is a promise that the domain and its subdomains will keep serving HTTPS for that long, and browsers honour it even if you change your mind. Start with a short max-age, confirm every subdomain has a valid certificate, and only then extend it. Preload lists are harder still to reverse, so treat that step as permanent.
Where this lands on HostingFast
Free SSL is on every plan, issued as soon as your domain points at us and renewed automatically before it can lapse, so the certificate half of this is not something you administer. Mailboxes on your own domain come as part of the plan — email is included, never sold back to you at checkout.
Read next: SSL Certificate for the credential, TLS for the handshake, HTTP Status Codes for what those redirects actually return, and Encryption for the mathematics.
A hundred terms, each with the mechanism
To us, jargon nobody explained is a service defect. This glossary is the support team's collected translations — published with the curl commands, the headers and the round-trip counts still in them.
Order an annual plan and the first year of your domain registration costs you nothing.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Round trips counted
Redirects and negotiations are expressed as hops, because that is the unit a visitor on mobile actually pays in.
Fix at source, not in output
Where a plugin can paper over a data problem on every request, the entry says how to fix the data instead.
Commitments flagged as commitments
HSTS max-age and preload are hard to reverse, and the entry says so before you set them, not afterwards.
Commands you can paste
curl -sIL and wp search-replace --dry-run beat clicking around a settings screen hoping something changed.
Wired to its neighbours
HTTPS runs into SSL Certificate, TLS and HTTP Status Codes — the credential, the handshake and the verdict.
This term, landed
HTTPS defined, its redirect chain measured and its mixed content located — enough to finish a migration properly.
Quick Start
From order to online
- 1
Trace the chain with curl
curl -sIL http://example.com and count the Location headers. Three hops is common and two of them are usually removable.
- 2
Collapse it to one redirect
A single rule that reaches the canonical URL in one move, replacing the stack of rules added over the years. Re-run curl: one 301, then 200.
- 3
Clear mixed content at source
Find the URLs in the browser console, then correct them in the database with a dry-run search-replace before committing to it.
Built In
Loaded onto every plan
- Free SSL on every plan, renewed automatically before it can lapse
- Real SSH, plus Git and Composer, on the developer-focused plans
- Mailboxes on your own domain, included with the plan
- LiteSpeed caching built into the server rather than bolted on by plugin
- Year one of your domain free when you order annually
- WordPress Toolkit handling core and plugin updates for you
- Human support on duty every hour of every day
- Your existing site moved over by our engineers, free of charge
- Upgrades applied in place — changing plan is not a migration
- Zero setup charges — there is no joining fee, ever
Frequently Asked
What people ask us most often
How many redirects should sit between the bare domain and the final URL?
One. curl -sIL http://example.com will usually show three on a site that has been migrated more than once — protocol, host and trailing slash, each added by somebody solving a different problem. Replace them with a single rule that lands on the canonical URL directly, then confirm with the same command: one 301 followed by a 200 and nothing in between.
How do I find mixed content on a live site?
The browser console names every blocked or upgraded resource by URL, which is the fastest inventory you will get. Then fix it in the data rather than in the output: wp search-replace with --dry-run shows how many rows are affected before you commit. A plugin that rewrites HTML on every request hides the problem and charges you for it on every page load.
Does TLS cost measurable time on a page load?
Barely, and the arithmetic now runs the other way. The handshake is cheap on modern hardware, and HTTP/2 and HTTP/3 — which browsers only offer over TLS — usually leave a secure site faster than its insecure predecessor. If a site got slower after a migration, look at the redirect chain and any output-rewriting plugin, not at the encryption.
Is HTTPS included, or is it an add-on?
Included on every plan. The certificate issues as soon as your domain points at us and renews itself well before expiry, and cryptographically it matches any paid DV certificate. The paid options exist for wildcard coverage and organisation validation, which the vast majority of sites never need.
Keep reading
HTTP Status Codes
The three-digit verdict on every response, including the 301s your redirect chain is made of.
TLS (Transport Layer Security)
The handshake underneath, and the round trips a current protocol version removes.
How to Force HTTPS on Your Site
Forcing HTTPS in one hop rather than three, and confirming it with curl afterwards.
Charity Hosting
Discounted hosting for charities and nonprofits, with nothing essential removed.
Website Builder
Drag, drop, publish — a no-code builder on genuinely fast hosting.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
One hop to the canonical URL.
Free SSL on every plan, LiteSpeed in the server, NVMe underneath — and a renewal price identical to the one you signed up at.
View Charity Hosting plans