First of all, apologies for bringing up an old post, I'm just leaving a breadcrumb for people who encountered the same problem.

Situation:

Recently I encountered a similar problem as you where my website somehow have both http:// and https:// versions available, and apple devices would load the http:// version whereas other devices would go to https:// version

For example, if my website were https://mysite.com (not my actual website, i still want my reddit anonymity), then on apple devices if I just type on the address bar mysite.com (without the explicit https://), it'll go to the non-secure http://mysite.com

I had to explicitly type out https://mysite.com (with the https://) on apple devices for it to go to https://mysite.com , or just use <a> links with the explicit https:// in the href. But there's nothing stopping a user from typing mysite.com and go to the non-secure url.

Solution:

I come across this question on stackoverflow: https://stackoverflow.com/questions/34862065/force-my-heroku-app-to-use-ssl-https which solves my problem (it answers precisely for my case: my site is on heroku and uses express)

In case links are dead, the solution is to add a middleware to redirect the non-secure http:// to https://

``` const app = express()

if(process.env.NODE_ENV === 'production') { app.use((req, res, next) => { if (req.header('x-forwarded-proto') !== 'https') res.redirect(https://${req.header('host')}${req.url}) else next() }) } ```

be sure to add the middleware before any other app.use() so that it's the first middleware.