Latest web browser will show your website as "insecure" when a visitor visit your site via the HTTP protocol.
Some visitors may visit your website URL without specifying HTTPS in the web browser address bar.
To always force your website to HTTPS in Windows IIS, enter the REWRITE rule below in your web.config file located inside the web folder wwwroot.>
The tag <REWRITE> must reside within the tag <SYSTEM.WEBSERVER>.
<?xml version="1.0" encoding="UTF-8"?><configuration> <system.webServer> <rewrite> <rules> <clear /> <rule name="Redirect to https" stopProcessing="true"> <match url=".*" /> <conditions> <add input="{HTTPS}" pattern="off" ignoreCase="true" /> </conditions> <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" appendQueryString="false" /> </rule> </rules> </rewrite> </system.webServer></configuration>