Serve the site over HTTPS

Why it matters

Without HTTPS everything visitors send and receive, including passwords and form data, can be read or changed by anyone on the network path. Browsers also label plain http pages as not secure.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Get a certificate for example.com (and for the www or apex twin if it serves the site too). Let's Encrypt certificates are free; most hosting control panels have an SSL or Let's Encrypt switch, and on your own server an ACME client such as certbot requests and renews them.
2. Configure the web server to listen on port 443 with that certificate, and allow port 443 through the firewall.
3. Stage 1: open https://example.com/ and the important pages (login, checkout, forms) and fix any certificate or mixed content warnings. Keep http working while you test.
4. Stage 2: only when HTTPS works everywhere, redirect http to https permanently (see the HTTP to HTTPS redirect fix). Add HSTS later, starting with a short max-age.

# certbot edits the nginx or Apache config for you (use --apache for Apache)
sudo certbot --nginx -d example.com

# check that HTTPS answers
curl -sI https://example.com/ | head -n 1

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Stop redirecting HTTPS to HTTP
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS