We're thinking to drop HTTP support, Thoughts?

Question

We're planning to completely remove HTTP support across all our sites, endpoints, APIs. Meaning: Stop serving at 80 port. By doing so we'll be able to remove servers, nginx, loadbalancers, etcs that manage http traffic.This will save us a few bucks, reduce complecity and improve security.Currently we're already forward(301) all http requests to https. Most of them bots, garbage.Thoughts? Can we expect any problems? SEO? Browsers to refuse to connect? Or any unexpected problems?

toast0 · Accepted Answer

If all you do on http is send a redirect to https, you might be able to do that on the loadbalancer itself, or have a minimum sized pool of origins that does it for all of your hosts, so all your loadbalancers would have port 80 sent to them.
If you have any inbound links to http content, you really should endeavor to make those continue to work forever.
All that said, when I ran a high volume website, I got hsts preloaded, and served favicon with hsts headers, but generally didn't redirect content pages to https. If the user had a browser supporting hsts, they would be on https, otherwise maybe they want to see the content, but their browser can't manage modern https. The page was public information only though, if you have private information, you may reasonably prefer to have server acceptable TLS or nothing.

panarky · Answer

If your domain has had HSTS for at least a year (long enough to be recognized by modern browsers) then you should be good. If not, then you'll still need port 80 for redirects.

softwaredoug · Answer

Is there any way to leave the bots on port 80? As most browsers send users to https, you could use port 80 access as a signal these users are likely bots and should be treated as such? I just mention this because I know bot detection is itself an annoying problem... maybe you&rsquo;ve found one possible way to at least learn who the bots are?

chefkoch · Answer

f you already forward every http request to https, then how are you serving http and how much?