HTTP to HTTPS redirects not working for sites using custom domains

Incident Report for Framer

Resolved

Sites using custom domains should redirect any requests using unencrypted HTTP to use encrypted HTTPS when they first get accessed by a browser. Unfortunately this was unavailable between about ~12:15 CEST and ~21:15 CEST.

Note that the sites were available using HTTPS, and if a user had ever opened the site before they would also be redirected by their browser immediately as Framer configures all sites to use "strict transport security". Many browsers also use a "HTTPS by default" policy and would similarly not have been exposed to this problem.

Posted Oct 25, 2023 - 12:00 CEST