I've created a small project, where I scan a 1000+ sites for TLS implementation, including
- Does a https site exist
- Does the site redirect from http to https
- Various other info about the cert
Surprisingly, when I first ran the scan, a lot of sites were NOT redirecting users to https, even though the a https site existed (what a waste!), but gradually most of them begun redirecting users.
Obviously this is slightly less efficient that HTTP Status codes (since the site needs to fully load before redirection), but looks like a reasonable way to implement a redirect -- especially if the original http site is left empty.
Are there any security considerations around HTML Meta Tag redirects? And should I start marking meta-tag redirects as 'good'?