Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any problem with using a 301 redirect to force all traffic to go to a secure-only site? We originally had redirect rules, but enforcing SSL-only seemed more secure. Here is how we set it up:

Site 1: 
  Require SSL set
  Bound to 443 only

Site 2:
  Bound to 80 only
  Empty folder - no actual html or other data
  301 Redirects to

This seems to work beautifully, but are there any issues with doing this? Would any browsers not recognize the 301 redirect, or could there be security warnings during the redirect?

share|improve this question
You could do the same with just 1 site (bound to both 80 & 443) and redirect all HTTP requests to HTTPS with the help of 1 URL Rewrite Rule. The end result will be exactly the same. – LazyOne Jun 28 '11 at 7:47
The problem is that we end up relying on the rewrite rules, which someone could screw up since they're under control of developers (i.e. in web.config) – Beep beep Jun 28 '11 at 15:11
Agree, that sometimes can be problematic to keep under control – LazyOne Jun 28 '11 at 15:14
up vote 2 down vote accepted

As long as you use a full domain name ( you won't receive any SSL warnings.

Redirecting with a 301 will not cause any issues; simply put, it's a big part of the HTTP 1.0/1.1 protocols and should not cause any issues with any 'real' browsers or bots.

share|improve this answer
Thanks - one of my big concerns was that everyone on the web was suggesting code changes, fancy URL rewriting logic, and other methods to enforce SSL. My 'solution' seemed so simple that I figured I missed something. – Beep beep Jun 28 '11 at 5:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.