Should http:// redirect to https:// on my site?
Yes, and permanently. Having a certificate is only half the job: if the old insecure address still serves pages instead of sending people to the secure one, you are running two copies of your site and telling machines to treat them as separate places.
What it actually is
A redirect is a signpost rather than a copy. When someone arrives at the insecure address, the server should not serve them the page — it should tell them, permanently, that the page has moved to the secure address, and let their browser follow. Permanent is the important word: it tells search engines to transfer everything the old address had earned to the new one, rather than treating them as rivals.
Why it matters
Without it, every link anyone has ever made to your site is potentially pointing at a second, insecure twin. The authority you have built up gets divided between two addresses that both look legitimate, and neither ranks as well as one would. It also undoes the trust work the certificate was for, because there is still a version of your site a visitor can reach with a warning attached.
What good looks like
A request to the insecure address never returns a page. It returns a permanent redirect straight to the secure equivalent of that exact URL — the same path, not the homepage — and it does so in one hop rather than bouncing through several addresses on the way.
Being honest about it
This is genuinely close to free once HTTPS is in place, and most modern hosting does it by default, so a failure here usually means something bespoke is sitting in front of the site. Where it does bite, it bites quietly and for a long time: nothing breaks, nothing errors, the site simply underperforms in a way that looks like ordinary competition.
Where most sites go wrong
The most common failure is a redirect that works for the homepage and forgets every other page, so deep links stay on the insecure version indefinitely. The second is a redirect marked temporary rather than permanent, which reads to a search engine as "check back later" and never transfers the authority. The third is a chain — insecure to secure, then bare to www, then a trailing slash — where each hop is fine and the total is wasteful.