diff --git a/Keter/Proxy.hs b/Keter/Proxy.hs
index ebc8391..c4abe74 100644
--- a/Keter/Proxy.hs
+++ b/Keter/Proxy.hs
@@ -41,6 +41,7 @@ import           Network.Wai.Application.Static    (defaultFileServerSettings,
 import qualified Network.Wai.Handler.Warp          as Warp
 import qualified Network.Wai.Handler.WarpTLS       as WarpTLS
 import           Network.Wai.Middleware.Gzip       (gzip, GzipSettings(..), GzipFiles(..))
+import           Network.Wai.Request               (appearsSecure)
 import           Prelude                           hiding (FilePath, (++))
 import           WaiAppStatic.Listing              (defaultListing)
 import qualified Network.TLS as TLS
@@ -134,7 +135,7 @@ withClient isSecure useHeader bound manager hostLookup =
         case mport of
             Nothing -> return (def, WPRResponse $ unknownHostResponse host)
             Just ((action, requiresSecure), _)
-                | requiresSecure && not isSecure -> performHttpsRedirect host req
+                | requiresSecure && not (isSecure || appearsSecure req) -> performHttpsRedirect host req
                 | otherwise -> performAction req action
 
     performHttpsRedirect host =