The website does not automatically redirect to https (the accepted practice), but it's not as bad itself.
The login page does not redirect you to HTTPS if you come from http://
@ DC: No, It doesn't. Clear your browser history, Close all tabs then directly go to unrealsoftware.de. It's not gonna redirect you to HTTPS. (once tested on chrome on mobile, once on chrome on windows 10)
@ VADemon: Which browser are you using? It always redirects to HTTPS for me (Chrome on Win 10)
I think there's some change that broke the HTTPS redirect, probably related to CS2D avatar problem we talking about while diagnosing my USGN verication problem?
The reason browsers redirects you to HTTPS automatically because browser remembers that it should only be visited under HTTPS.
I can confirm it doesn't redirect with
$ curl -v http://www.unrealsoftware.de
which sends the actual web content instead of sending redirect.
@ Mami Tomoe: I can't reproduce this for CS2D.com - it always redirects me. Can you give me a sample link which does not forward you? Which browser are you using?
@ MikuAuahDark: I now also enabled redirects for the other pages. I thought this isn't required for sites with HSTS.
Please let me know if you still experience any problems.
Okay that CS2D avatar download fun stuff isn't working again. Whatever. Stupid stuff.
And apparently its certificate leads to carnagecontest.com?
I guess we can't read the comics anymore
EDIT: Apparently there's a feature in chrome where if you type "thisisunsafe" anywhere it will reload the page and bypass the HSTS warning, and apparently weirdpals.unrealsoftware.de is actually carnagecontest.com
@ Varna97: I didn't setup weirdpals.unrealsoftware.de when moving to the new webserver. I may do that later but maybe I won't because I'm not planning to continue it anyway.
Also some other subdomains don't work properly anymore with my new setup. I'm aware of this issue.
@ Mami Tomoe: That's actually unrelated to HTTP(S). Won't work with either. I didn't enable the feature which automatically adds the file extension if it is missing.
I now also enabled redirects for the other pages. I thought this isn't required for sites with HSTS.
Web browsers and other programs that support HSTS do the redirecting for you. CURL doesn't.
The person experiencing the non-redirect is probably on an unsupported browser (which is weird considering all major browsers support it and redirect).
@ Yates: Chrome automatically attempting an HTTPS connection when pointed to HTTP is just Google going their own way, out of spec.
HTTP - HTTPS are different protocols and it is very much valid to host different resources behind different protocols.
us.de does not set the HSTS header.
I was using an old bookmark link pointing to HTTP. The only real issue was not HTTP per se but the lack of redirection on login/sign up pages.
If you try to open a not defined subdomain of unrealsoftware.de you get redirected to the content of carnagecontest.
As you use a let's encrypt certificate which is only valid for a few domains (you have set up), you will get an warning that the certificate is invalid.
I would recommend forwarding/redirecting a invalid subdomain to the www subdomain, or just let "the request die"
Buying a wildcard certificate would be not worth in my opinion.
PS: Is there still a way to access the old weirdpals comics?
//EDIT: just read the posts about this one (I was in another thread before, which I wasn't able to find anymore)