Redirect to HTTPS

What it checks

Whether http:// sends visitors to https://, permanently.

Why it matters

Visitors who type the address or follow an old link otherwise stay on an unencrypted page.

How to fix it

1. Redirect every http:// request to the same address on https://, with a 301 or 308.
2. Make it one redirect, not a chain.

server {
  listen 80;
  return 301 https://$host$request_uri;
}