Ideally, you should use HSTS preloads in combination with a 301 or 308 redirect. HTTP redirects can be intercepted by anyone who is a MITM (man-in-the-middle)

Ideally, you should use HSTS preloads in combination with a 301 or 308 redirect. HTTP redirects can be intercepted by anyone who is a MITM (man-in-the-middle) to your connection. (Such as a Wi-Fi hotspot owner, ISP, or someone attacking the network itself via DNS poisoning, ARP spoofing, etc.) So using _only_ HTTP redirects leaves you open to a [SSL Stripping attack][1]. A better option is to use a HSTS header. This ensures that once a user visits your site once over HTTPS, all subsequent visits will also happen over HTTPS. This makes SSL Stripping attacks harder, but still possible if the attacker is able to MITM your users on their first visit to your site. The best option is to get your site on the list of HSTS preloads. This list ships with web browsers, which will then _always_ load your site over HTTPS. A site that uses HSTS preloads is nearly immune to SSL Stripping attacks, and that's what Google is using here. Some browsers still don't support HSTS though, so you might not be able to rely entirely on HSTS preloads to redirect your users. For that reason, it's best to _also_ redirect users via 301 or 308 HTTP redirects, just in case. [1]: https://security.stackexchange.com/q/41988/29865 https://security.stackexchange.com/q/41988/29865