diff --git a/Services/Website/README.md b/Services/Website/README.md
index 3382af1..5e356a7 100644
--- a/Services/Website/README.md
+++ b/Services/Website/README.md
@@ -125,6 +125,19 @@ every `GET`/`HEAD` whose path ends in a slash is answered with a `301` to the fo
 `Location` is relative, so it keeps the request's own scheme and host. Other methods pass through, since a client may repeat a redirected `POST` as a
 `GET` and drop the body.
 
+### HTTPS redirect
+| Config key | Environment variable | Default | Description |
+| --- | --- | --- | --- |
+| `https.trustForwardedProto` | `HTTPS_TRUST_FORWARDED_PROTO` | `false` | Read the visitor's scheme from the `X-Forwarded-Proto` header and answer the plain-HTTP ones with `301 Moved Permanently` to the same path on `site.origin`. Enable **only** behind a reverse proxy that sets the header — it is the sole trigger. |
+
+Redirecting collapses the `http://` and `https://` copies of every page onto one address, which is what a search engine consolidates a site's signals against. Three details:
+
+- **`301`, not `302`** — a temporary redirect keeps the HTTP URLs indexed. Browsers cache it for a long time, so settle the target first.
+- **Target built from `site.origin`, not the `Host` header** — a client cannot steer it. An origin that is not itself HTTPS disables the middleware instead of looping.
+- **`/.well-known/` is exempt** — redirecting the ACME challenge path breaks certificate renewal.
+
+`docker-compose.yml` enables it for production; `docker-compose.override.yml` pins it off for local development.
+
 ### Logging
 | Config key | Environment variable | Default | Description |
 | --- | --- | --- | --- |