Always Use HTTPS is off

What it is

"Always Use HTTPS" is off, so plain HTTP requests are served rather than redirected.

Why it matters

The first request from a user who types the bare domain travels unencrypted, which is enough to steal a session cookie not marked Secure or to inject content before the redirect would have happened.

Check what plain HTTP does right now

What it does — and what it does not

Always Use HTTPS (SSL/TLS → Edge Certificates) 301-redirects every plain-HTTP request at the edge, for every hostname on the zone, before anything reaches your origin. What it does not do is stop the browser from *making* that first insecure request — the URL someone typed, the old http:// link in an email. The request still travels in plaintext once, and a network attacker can intercept it before the redirect comes back.

Pair it with HSTS

HTTP Strict Transport Security closes that first-request gap: after one visit, the browser upgrades itself and never sends plaintext again. Enable it under SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS) once you are confident every subdomain serves HTTPS:

Start with a shorter max-age if any subdomain’s HTTPS story is uncertain — HSTS is deliberately hard to undo, because undoing it is what an attacker would want.

How lumioguard fixes it

The scan reads both settings together and flags a zone that redirects but never commits (no HSTS) or commits without redirecting. The fix arrives as a guide with the two toggles in the right order and the curl checks to verify each.