https://shipreadyai.dev/learn/findings/o1-https-redirect-missing

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Plain http traffic is not sent on to https

Someone who reaches the plain http address stays on an unencrypted connection, so anything typed on that page travels in the clear.

## Why AI-built apps get this

An AI builder gives you HTTPS on the hosted address and stops there. The moment you point your own domain at it, the redirect, the certificate and every hard-coded http:// in a copied snippet become yours. Nothing in the build warns you, because from the inside everything still works.

## Evidence line

GET http://example.com returned 301 to https://example.com, certificate valid to 2026-12-01

## The fix

Turn on the force https or automatic https redirect setting in your hosting dashboard so the plain address answers with a redirect to https.

## Prompt

Plain http requests to this app do not redirect to https. Turn on the force-https option in your hosting dashboard, or add a permanent redirect at the server. Verify with curl -I on the http address.