Site does not encrypt unless I key in https://

[joenobel]

When user enters url exoplanetary.systems in URL, my site is not encrypted (connection is not secure)
when user enters url https://exoplanetary.systems, my site is encrypted (secure connecton)
This happens for any browser, any os.

On Eapps ispmanager console:
Name is exoplanetary.systems
Aliasses are: *.exoplanetary.systems www.exoplanetary.systems

Need to get secure no matter how a user navigates to page.

My domain is: exoplanetary.systems

I ran this command: (in browser)
when user enters url exoplanetary.systems, not encrypted
when user enters url https://exoplanetary.systems, is encrypted

It produced this output: not encrypted

My web server is (include version): Apache (don’t know version)

The operating system my web server runs on is (include version): centos (don’t know version)

My hosting provider, if applicable, is: eapps

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): ispmanager

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): no

[JuergenAuer]

Hi @joenobel

@joenobel

My domain is: exoplanetary.systems

the site doesn't have redirects http -> https ( https://check-your-website.server-daten.de/?q=exoplanetary.systems ):

Domainname	Http-Status	redirect	Sec.	G
• http://exoplanetary.systems/
68.169.54.161	200		0.253	H
• http://www.exoplanetary.systems/
68.169.54.161	200		0.260	H
• https://exoplanetary.systems/
68.169.54.161	200		1.430	I
• https://www.exoplanetary.systems/
68.169.54.161	200		1.210	I

If a user types exoplanetary.systems (or same with www), then http is used.

Perhaps add something like

RewriteEngine on
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]

in your port 80 vHost.

Then recheck your domain. Browsers cache such redirects, so a browser may show a redirect that isn't defined.

PS: Compare the result with the result of other domains (Grade B or A).

[joenobel]

Thank you for the quick turnaround.
ISPmanager at EAPPS has a check button “Redirect HTTP-requests to HTTPS”. I did not know what that meant. I checked it off. And now it works. You solved my problem though not exactly as you instructed.