Transport layer · Beginner · 10 minutes
Force HTTPS Once, and Measure the Redirect Chain
Your homepage takes three hops to reach the page it should have served first, and every visitor pays for all three.
The short answer
Measure the chain before you add to it: curl -sIL against your bare http address prints every hop. http to https, then non-www to www, then a trailing-slash correction is three round trips before a single byte of content is served, and each one is a full request.
Then use exactly one mechanism. The panel's Force HTTPS toggle, an .htaccess rewrite and a plugin all do the same job, and any two of them together produce a loop. Redirect once, to the canonical host and scheme in a single hop, and confirm the count fell.
By the HostingFast team · Reviewed 12 August 2026
Beginner
Difficulty grade
5
Stages
Free
Support cost
Proven
Verified on
Ten minutes, and the outcome is a measurable one: a redirect count you can read before and after. It assumes you can edit .htaccess or use the panel toggle, and run curl or an equivalent.
Mixed content and HSTS both get a section, because a padlock that holds on most pages is not finished, and HSTS is the part people either skip or over-commit to.
Count the chain before you add to it
curl -sIL http://yourdomain.com/ prints each response in the chain with its status code and Location header. Every 301 in that list is a full request-response cycle for the visitor: connection setup, latency, nothing rendered.
One hop is acceptable and unavoidable for anyone typing a bare address. Three is common and entirely avoidable — it means three separate rules each correcting one thing. Rewrite them as a single redirect that lands on the canonical scheme and host in one move.
Choose exactly one mechanism
cPanel's Domains page has a Force HTTPS toggle per domain, which is a configuration-level redirect and the cleanest option. An .htaccess RewriteRule does the same thing where you want the rule versioned alongside the site. A plugin does it in PHP, which is the slowest place to do it.
Two of those at once is how ERR_TOO_MANY_REDIRECTS happens. The subtler version involves a proxy or load balancer terminating TLS and forwarding plain HTTP to the origin: the origin sees http, redirects to https, the proxy forwards http again, and the loop never breaks until the rule reads X-Forwarded-Proto instead of the connection scheme.
Mixed content and the address settings
An https page requesting an http asset is either blocked outright or downgrades the lock, depending on the asset type and the browser. The console names each offender, and in WordPress they are usually absolute URLs written into the database when the site was on http.
Set both the WordPress Address and Site Address to https in Settings, General, then run a database search-replace for embedded http references — over WP-CLI, so serialised values survive it. Check the console on the homepage, a post, and a page with an embed, because those three cover most of what breaks.
HSTS, ramped rather than switched on
Strict-Transport-Security tells a browser to use https for this host for a stated period without asking, which removes the first hop entirely for returning visitors. Start with a short max-age, confirm a few clean weeks, then raise it.
includeSubDomains binds every subdomain to the same rule, and the preload list is effectively a one-way door — a browser that has preloaded your domain will not accept plain HTTP from it, no matter what you change afterwards. Both are worth having, and both after the short max-age has proved uneventful.
The platform these hops were counted on
Every redirect and header here was tested on the stack we operate: the panel toggle, LiteSpeed handling the rewrite, the same defaults. The counts you take will come from the same tooling.
Order an annual plan and the first year of the domain registration costs you nothing at all.
- Hops counted before and after
- One mechanism, never two
- Mixed content actually swept
- Engineers on shift at any hour
Why HostingFast
Standard on every plan
The chain measured
curl -sIL counts your hops, and the count is almost always higher than anybody expects it to be.
One mechanism only
Panel toggle, .htaccess rule or plugin — pick one, because two of them together is a loop.
The proxy case covered
X-Forwarded-Proto, and why a TLS-terminating proxy makes the origin think every request arrived over http.
Mixed content swept
Embedded http URLs found and replaced, so the padlock holds on every page rather than most of them.
HSTS ramped safely
A short max-age first, raised once the weeks come back clean, with preload treated as one-way.
Redirect available per domain
Force HTTPS is a toggle in the panel, so the clean configuration-level mechanism is already there.
Quick Start
From order to online
- 1
Count the current chain
curl -sIL against the bare http address. Write down how many hops there are, because that number is the thing you are about to improve.
- 2
Check https renders correctly first
Herding visitors onto a broken https page is worse than not redirecting. Open it, check the console, then continue.
- 3
Disable every redirect source but one
Panel toggle, .htaccess rule and plugin all do this job. Turn off two of the three before adding anything new.
- 4
Redirect to the canonical host and scheme in one hop
One rule that fixes scheme and host together, rather than two rules each fixing one. Re-run the curl and confirm the count dropped.
- 5
Sweep mixed content, then add HSTS with a short max-age
Update the address settings, search-replace embedded http URLs over WP-CLI, then set a modest max-age and raise it after a few clean weeks.
Built In
Loaded onto every plan
- Free SSL on every plan, renewed automatically before it can expire
- LiteSpeed caching in the server itself, not bolted on by plugin
- NVMe SSD storage on every tier, not just the expensive ones
- WebP image conversion built in at no extra cost
- Daily backups with restores you trigger yourself from the panel
- Engineers on shift every hour of every day, not a queue that opens at nine
- First year of the domain included when you order annually
- No setup fee on any plan, ever
- Staging environments for testing before anything ships
- cPanel — the panel most of the industry already automates against
Frequently Asked
What people ask us most often
How many redirects should a request take?
One at most, and zero for anybody arriving at the canonical address. Count them with curl -sIL: each hop is a full round trip before any content is served, so three rules each correcting one thing is three times the cost of a single rule correcting everything.
I get a redirect loop behind a proxy — why?
Because the origin is being handed plain HTTP. A proxy or CDN terminating TLS forwards the request over http, so a rule that inspects the connection scheme redirects to https, the proxy forwards http again, and it never terminates. Have the rule test X-Forwarded-Proto instead, or terminate TLS at the origin.
Is the PHP version selectable per site?
Yes — PHP is set per site from the control panel, so a legacy application and a current one can run side by side on one account. Extensions and per-site tuning sit on the same screen, and none of it goes anywhere near a support ticket.
How does billing and auto-renewal work?
You pay by credit or debit card through a secure checkout, and renewals bill at the same rate as your original order. Every invoice lives in your client area, and auto-renewal switches off with a toggle in your account — no phone call required.
Keep reading
How to Free Up Mailbox Storage
Find the bytes, expunge properly, and confirm the usage figure actually fell.
How to Set Up DKIM Signing
Signatures that verify, selectors that resolve, and a dkim=pass you can read.
Brute-Force Attack (Glossary)
The attack that repeated login guesses invite, defined in one screen.
Email Hosting
Real mailboxes on your own domain for one flat rate, website elsewhere or not.
VPS Hosting
KVM virtual servers with root access, DDoS filtering and one flat monthly price.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Serve it in one hop.
Free SSL, LiteSpeed in the server itself, NVMe on every tier, and engineers on shift at any hour of the night.
View Email Hosting plans