A site can serve HTTPS correctly while also serving ordinary HTTP without redirecting visitors. SSLBoard checks the observed HTTP listener behavior and flags hosts that listen on port 80 but do not report a redirect to HTTPS.
Interpret the result
A redirect finding means HTTP was reported as listening and a redirect to HTTPS was not confirmed. Review the response and redirect destination. If HTTP is not listening, that is a different configuration from an HTTP site serving content without a redirect.
An unknown or failed HTTP check does not prove either behavior. The report’s missing-redirect table can include a listening host whose redirect result is not true, so inspect the evidence when the probe was incomplete.
Choose behavior for the service
For a public website that should lead users to HTTPS, configure the responsible web server or proxy to send the intended redirect. APIs, health checks, and specialized services may have different requirements; assess the actual route and client behavior before making a blanket change.
A redirect and HSTS perform different jobs. The redirect responds to an HTTP request, while an established HSTS policy tells a supporting browser to use HTTPS before making that request. HSTS documentation explains the distinction.
Verify after deployment
Run a fresh scan and confirm the redirect finding is resolved for the affected hosts. Also verify that the destination is the intended HTTPS site and does not create a loop. A correct redirect does not repair a certificate error at its destination.