How to Secure Your Website With HTTPS

HTTPS is no longer something to reserve for checkout and login pages. It protects the connection between every visitor and your site, including ordinary pages that do not appear to contain sensitive information.

People still commonly call these “SSL certificates,” although current connections use TLS. The name has stuck; the important part is serving the site over HTTPS with a valid certificate.

Get a certificate

Start with a certificate from a trusted certificate authority. Let’s Encrypt provides free certificates, and many hosting providers can request and renew one automatically.

If your host has a one-click HTTPS option, use it. Manual certificate installation is useful when you manage the server yourself, but it also means handling renewals. Certificates expire, usually at the least convenient moment.

For a manual setup, the exact steps depend on the web server. You may need to generate a certificate signing request, prove control of the domain, install the returned certificate, and configure the matching private key.

Move the whole site to HTTPS

Once the certificate works, redirect every HTTP request to its HTTPS equivalent. Keep the path and query string intact so old links continue to reach the right page.

Also check templates, forms, stylesheets, scripts, images, canonical URLs, and other hard-coded references. An HTTPS page that loads an asset over HTTP creates mixed content, which browsers may warn about or block.

Test more than the home page

Open several types of page and use the browser’s developer tools to look for certificate or mixed-content errors. Then run the domain through SSL Labs’ SSL Server Test to inspect the public server configuration.

Do not stop after seeing a padlock on one page. Check redirects, subdomains, certificate renewal, and any third-party assets the site depends on. HTTPS is simple for visitors precisely because the server setup does the boring work correctly.