Redirect and mixed-content check
What actually happens between typing your name and seeing your page.
Every hop is a round trip
A redirect is not free. Each one is a full journey to the server and back — a DNS answer, a connection, a handshake, a wait — before a single byte of the actual page arrives. On a fast office connection that is invisible. On a phone on mobile data in Cambodia, three hops is most of a second spent going nowhere.
The common case is two redirects done as two steps: http to https, then www to non-www. Configured properly that is one step, and the fix is usually a single line in the server config rather than a project.
One address, not two
If both www.yoursite.com and yoursite.com serve the site instead of one redirecting to the other, search engines see two sites with identical content and split the credit between them. Links earned by one do not help the other.
This check tries all four front doors — http and https, www and bare — and reports where each one ends up. They should all end at exactly one address. Two different endings is the single most common finding here, and one of the cheapest to fix.
Mixed content is the other half of moving to https
A site can serve its pages over https and still pull images, scripts or fonts over plain http. Browsers block the dangerous ones outright — a script or a stylesheet simply does not load — and mark the rest insecure, which is how a site ends up half broken and nobody can say why.
It is nearly always left over from a migration where the pages were updated and the hard-coded URLs inside them were not. This reads the home page and lists what is still on http, with the exact addresses, so the find-and-replace is a short one.
HSTS, and why the first hop disappears
Strict-Transport-Security tells the browser to use https for your site by itself, without asking. Once it is set, the http hop stops happening at all for anyone who has visited before — the browser upgrades the address before it sends anything.
It is one header, it costs nothing, and it removes both a redirect and the one moment when a visitor’s request could be intercepted. Set a short max-age first if you are nervous; the mistake it protects against is hard to undo quickly.