Web security · appears in CAIQ, SIG, SOC 2
Does the public web endpoint redirect HTTP to HTTPS within a single hop?
Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).
How to answer this
Whichever verdict your domain earns, this is the wording to put in the response box. Reviewers mark an answer down for vagueness more often than for a "No", so say which state you are in and what evidences it.
- Yes
- HTTP traffic redirects to HTTPS cleanly on the public web endpoint
- Partial
- Redirects work but with chain or scheme warnings
- No
- The HTTP-to-HTTPS redirect is missing or broken
Controls this evidences
| Framework | Control | Why it maps |
|---|---|---|
| SOC 2 | CC6.6 | HTTP→HTTPS redirect chain prevents plain-text fallback. |
| ISO 27001 | A.8.23 | — |
| NIST 800-53 | SC-7 | — |
Domain Posture is not an audit and does not replace an auditor. See methodology v1 for how each verdict is reached.
When a "Yes" stops being true
HTTP no longer redirects to HTTPS in a single clean hop, or a plain-text hop reappeared.
That is the whole problem with answering a questionnaire from a screenshot: the answer was true the day you took it. A signed evidence pack is dated, and a schedule re-checks it so you find out before your reviewer does.