SteadyHost

HTTPS and redirecting HTTP to HTTPS

HTTPS encrypts the traffic between visitor and website. Without HTTPS, browsers show "Not secure" in the address bar, and visitors who type http:// should automatically end up on the secure version.

Check your website now

Why HTTPS?

With HTTPS, nobody along the way can read along or alter the page, for example on a public Wi-Fi network. Browsers mark websites without HTTPS as "Not secure", and Google uses HTTPS as a (light) signal when ranking search results.

For HTTPS you need an SSL/TLS certificate. Most hosting providers offer free certificates from Let's Encrypt, which are renewed automatically.

Redirecting HTTP to HTTPS

Even when HTTPS works, visitors often type just your domain name or follow an old link with http://. A permanent redirect (301) sends them to the secure version automatically.

With many hosting providers, you turn this on with a single checkbox ("Force HTTPS"). If you manage the server yourself, you configure it in the web server.

nginx
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Redirecting with .htaccess

If you use Apache (for example on shared hosting), an .htaccess file in the root folder of your website will do the job.

.htaccess (Apache)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Next: mixed content and HSTS

Load images, scripts and stylesheets over https:// as well. Browsers partially block an HTTPS page that loads resources over http:// (mixed content).

Once everything works over HTTPS, also turn on the Strict-Transport-Security header. It tells browsers to open your site only over HTTPS from then on.

How SteadyHost rates HTTPS

  • OK: HTTPS works and http:// redirects to https:// (or the site is only reachable over HTTPS).
  • Warning: HTTPS works, but http:// isn't redirected.
  • Problem: the website isn't reachable over HTTPS, or browsers don't accept the certificate.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.

More guides