Bare domains automatically receive https://. Audits run live against the target site.