How do I get and force HTTPS/SSL?

HTTPS is the secure version of HTTP. It encrypts data between a visitor’s browser and your site using TLS (what most people still call “SSL”). That encryption protects logins, payments, forms, and even basic browsing from eavesdropping or tampering. “Getting HTTPS” means obtaining a TLS certificate and configuring your server to use it. “Forcing HTTPS” means making sure every request ends up on https://—no matter what the visitor types or what link they follow.

Below is a practical, step-by-step guide that works for most websites.

What you need before you start

A domain name (e.g., example.com)
Control of DNS for that domain (so you can add records when needed)
Access to your hosting/platform (web server config, control panel, or managed platform settings)

If you have a CDN (Cloudflare, Fastly, etc.) or a managed host (Shopify, Wix, Squarespace), your process may be mostly “toggle it on.” If you run your own server (Nginx/Apache), you’ll do a bit more configuration.

Get an HTTPS certificate

A TLS certificate proves your site is really your site.

Option A: Use a free certificate (recommended for most sites)

Let’s Encrypt is the most common free certificate authority. Many hosts integrate it so you can enable it with one click.

How it’s usually issued:

HTTP-01 challenge: the CA checks a temporary file on your website
DNS-01 challenge: you add a DNS TXT record (good if you don’t have port 80 reachable or want wildcard certs)

Pros: Free, widely trusted
Cons: Certificates are short-lived (typically renewed automatically)

Option B: Use a paid certificate

Paid certificates can be useful if you want certain support, warranties, or specific organizational validation types, but for most websites, Let’s Encrypt is enough.

Option C: Use your platform’s built-in SSL

Platforms like Cloudflare, Netlify, Vercel, GitHub Pages, and many managed hosts can provision certificates automatically.

Install/configure the certificate on your server or platform

This depends on where your site runs. Common scenarios:

Managed platforms (easiest)

You typically:

Add your domain
Verify DNS
Click “Enable HTTPS” (or it’s enabled automatically)
Turn on “Force HTTPS” in settings

Traditional hosting (cPanel/Plesk)

Often:

“SSL/TLS” → “Let’s Encrypt” → issue certificate for your domain
Or upload a purchased cert (certificate + private key + chain)
Then enable “HTTPS redirect” if offered

Self-managed server (Nginx/Apache)

You install a certificate and key files, then configure your virtual host to serve on port 443 with TLS enabled. (If you’re on Linux and want automation, tools like Certbot can issue and configure certs for you.)

Force HTTPS (redirect HTTP → HTTPS)

Once HTTPS works, forcing it ensures all traffic uses encryption.

Best practice: Redirect at the edge or web server

Do it at:

CDN / load balancer (best performance)
or Nginx/Apache (common and reliable)
or app/framework middleware (works, but usually not ideal as the primary layer)

You generally want a permanent redirect (301) from:

http://example.com/* → https://example.com/*
and often also normalize www vs non-www (choose one canonical host)

Example behavior:

http://www.example.com/about → https://example.com/about

Avoid redirect loops

Redirect loops happen when:

Your CDN terminates SSL but your origin server thinks requests are HTTP
Your app forces HTTPS while the proxy does something different

Fix loops by setting and honoring headers like X-Forwarded-Proto: https or using your platform’s “Flexible/Full/Strict” SSL modes correctly (Cloudflare users see this a lot—“Flexible” can cause loops if the origin also redirects).

Update your site to be “fully secure”

After forcing HTTPS, you want browsers to show a clean lock icon and avoid “mixed content” warnings.

Check for mixed content

Mixed content is when an HTTPS page loads something over HTTP, like:

images
scripts
CSS
fonts

Fix by:

changing asset URLs to https://
using protocol-relative URLs carefully (less common now)
preferably using relative paths (e.g., /images/logo.png) when possible

Update internal links and canonical tags

Make sure internal navigation links point to HTTPS
Make sure rel="canonical" uses HTTPS
Update sitemap URLs to HTTPS
Update structured data URLs if present

Update third-party integrations

Payment providers, webhooks, OAuth callbacks, API endpoints may need HTTPS URLs
Some services won’t accept non-HTTPS callback URLs

Enable HSTS (optional, powerful—use carefully)

HSTS (HTTP Strict Transport Security) tells browsers: “Always use HTTPS for this domain.”

Benefits:

Blocks downgrade attacks
Prevents accidental HTTP visits after the first HTTPS visit

Risk:

If you misconfigure HTTPS and enable HSTS, visitors may be unable to access your site until the policy expires.

A safe approach:

Start with a short max-age (e.g., a few hours or a day)
Increase gradually once you’re confident
Consider adding includeSubDomains only if all subdomains support HTTPS
Only consider preload once you fully understand the commitment

Verify everything works

Use a quick checklist:

Visit https://example.com → loads with no warnings
Visit http://example.com → redirects to HTTPS
Test a few deep URLs: http://example.com/page → HTTPS
Confirm www redirects correctly (if you chose non-www, or vice versa)
Check browser dev tools console for mixed content errors
Verify your certificate isn’t expired and covers the right names (domain + www if you use it)

Also update:

Google Search Console: add/verify the HTTPS property
Analytics settings if needed
CDN settings (make sure “Always use HTTPS” is on if applicable)

Common pitfalls (and how to avoid them)

Certificate covers only one hostname
If you use both example.com and www.example.com, your cert must cover both (or redirect one to the other).
Redirect chain (HTTP → HTTPS → www → HTTPS)
Try to do it in one step: HTTP + wrong host → HTTPS + canonical host.
Mixed content breaks styling/scripts
Fix hardcoded http:// asset links or old theme code.
Proxy/CDN mismatch causes loops
Ensure your origin and proxy agree on HTTPS mode (“Full/Strict” at the proxy, correct origin cert, correct forwarded headers).