How to check that a web page has switched from HTTP to HTTPS?

1. Visual check: Ensure that the browser's address bar displays "https://" and a lock icon instead of "http://".
2. Redirect check: Use browser developer tools (the "Network" tab) or command-line utilities (e.g., curl) to analyze HTTP requests and responses. Look for a 3xx status response (such as 301 Moved Permanently or 302 Found) with an HTTPS URL in the Location header.
3. Automated testing: Write a script that makes an HTTP request to the original URL and checks the response status and Location header.

Example in Python using the requests library:

import requests

def check_https_redirect(url):
    try:
        response = requests.get(url, allow_redirects=False)
        if response.status_code in [301, 302, 303, 307, 308]: # Check redirect statuses
            location_header = response.headers.get('Location')
            if location_header and location_header.startswith('https://'):
                return True, f"Redirects to HTTPS: {location_header}"
            else:
                return False, f"Does not redirect to HTTPS: {location_header}"
        else:
            return False, f"No redirect, status code: {response.status_code}"
    except requests.exceptions.RequestException as e:
        return False, f"Request error: {e}"

# Usage example:
url_to_check = "http://example.com"
is_redirected, message = check_https_redirect(url_to_check)

if is_redirected:
    print(f"Success: {message}")
else:
    print(f"Error: {message}")

4. Check for Strict-Transport-Security (HSTS) header: Ensure that the HTTPS page includes the Strict-Transport-Security header with appropriate directives (max-age, includeSubDomains, preload). This indicates browsers should always use HTTPS for this domain.

Example in Python:

import requests

def check_hsts_header(url):
    try:
        response = requests.get(url)
        hsts_header = response.headers.get('Strict-Transport-Security')
        if hsts_header:
            return True, f"HSTS header present: {hsts_header}"
        else:
            return False, "HSTS header missing"
    except requests.exceptions.RequestException as e:
        return False, f"Request error: {e}"

# Usage example:
https_url = "https://example.com"
has_hsts, message = check_hsts_header(https_url)

if has_hsts:
    print(f"Success: {message}")
else:
    print(f"Warning: {message}")

5. Check for mixed content: After switching to HTTPS, verify that all resources (images, scripts, styles) are loaded over HTTPS. Otherwise, browsers may block or warn about mixed content. This can be checked in the browser's developer console or with online tools.

Comparison table of methods:

Method	Advantages	Disadvantages
Visual check	Quick, simple	Not automated, user-dependent
Redirect check (curl)	Fast, diagnostic	Requires command-line skills
Automated testing	Repeatable, scalable	Requires coding
HSTS header check	Indicates enforced HTTPS usage	Does not guarantee redirect, only browser behavior
Mixed content check	Detects potential security issues	Requires content analysis of the page