1dollar.website

How to make your whole site use HTTPS

Your site should answer only over HTTPS, and send anyone who types the plain http:// address to the secure one with a permanent redirect. Most hosts give you a free certificate; the steps below switch on the redirect for your platform.

Last updated October 26, 2026

Not sure whether your site has this?

Paste your address. The checkup is free and shows what's flagged.

What our checkup looks for

Our free checkup requests your site over both HTTPS and plain HTTP. It flags a site with no working HTTPS, an http:// address that doesn't redirect, pages that load scripts or images over plain HTTP, forms that send to an http:// address, and servers that still accept TLS 1.0 or 1.1.

Redirect everyone to HTTPS

If http://yoursite.com still shows your site instead of redirecting, anyone on the same Wi-Fi can read or change what that visitor sees. A permanent (301) redirect sends every request to the HTTPS address.

Hosted platforms usually do this automatically once the domain is connected properly, so the fix there is often in the domain settings, not in code.

Choose where your site runs

Vercel
  1. Vercel serves HTTPS and redirects automatically for domains added in Project > Settings > Domains.
  2. If this domain isn't listed there, add it. If it points somewhere else, update its DNS records to Vercel's.
Netlify
  1. In Netlify open Site configuration > Domain management > HTTPS.
  2. Click 'Verify DNS configuration', then provision the certificate. Netlify redirects to HTTPS automatically once it's active.
Cloudflare
  1. In Cloudflare, open your domain > SSL/TLS > Edge Certificates.
  2. Switch on 'Always Use HTTPS'.
  3. Under SSL/TLS > Overview, choose 'Full (strict)' if your server has a certificate.
Copy this
SSL/TLS > Edge Certificates > Always Use HTTPS: On
GitHub Pages
  1. In your repository go to Settings > Pages.
  2. Tick 'Enforce HTTPS' (it can take a few minutes to become available after adding a custom domain).
Nginx
  1. Make the port 80 server block send everyone to HTTPS:
nginx
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}
Apache
  1. Add this to the top of your .htaccess file:
apache
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
WordPress
  1. In WordPress go to Settings > General and make sure both addresses start with https://.
  2. Add this to the top of your .htaccess file:
apache
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Shopify
  1. Shopify provides HTTPS automatically for connected domains. Check that your domain shows as connected in Shopify's domain settings.
  2. If your domain's DNS points somewhere else (an old host), update it to the records your platform shows.
Squarespace
  1. In Squarespace go to Settings > Website > SSL and choose 'Secure (preferred)' and 'HSTS Secure'.
  2. If your domain's DNS points somewhere else (an old host), update it to the records your platform shows.
Wix
  1. Wix provides HTTPS automatically for connected domains. Check that your domain shows as connected in Wix's domain settings.
  2. If your domain's DNS points somewhere else (an old host), update it to the records your platform shows.
Webflow
  1. Webflow provides HTTPS automatically for connected domains. Check that your domain shows as connected in Webflow's domain settings.
  2. If your domain's DNS points somewhere else (an old host), update it to the records your platform shows.

Fix mixed content ('Not secure' on an HTTPS page)

An HTTPS page that loads a script, image or video over http:// is called mixed content. Browsers block insecure scripts outright and mark the page as not fully secure. Scripts are the dangerous part: anyone on the network can swap them.

The fix is to change those links to https://. On WordPress, old http:// addresses are usually stored in the database from before the site had HTTPS. A form whose action address starts with http:// has the same problem: what people type is sent unencrypted.

Choose where your site runs

WordPress
  1. Install the 'Better Search Replace' plugin and replace http://example.com with https://example.com in all tables (back up first).
  2. For third-party files, change their links to https://. Most providers support it.
bash
wp search-replace 'http://example.com' 'https://example.com' --all-tables
Any other site
  1. Change every http:// link to a script, stylesheet, image or video on your pages to https://.
  2. As a safety net, add this directive to your Content-Security-Policy so browsers upgrade the rest:
Copy this
Content-Security-Policy: upgrade-insecure-requests

Turn off TLS 1.0 and 1.1

TLS is the encryption behind HTTPS. Versions 1.0 and 1.1 have known weaknesses and every current browser supports 1.2 and 1.3, so leaving the old ones on only helps attackers.

Choose where your site runs

Nginx
  1. In your nginx config (http or server block), set:
  2. Then run sudo nginx -t and reload.
nginx
ssl_protocols TLSv1.2 TLSv1.3;
Apache
  1. In your SSL config (often ssl.conf or the :443 virtual host), set:
  2. Reload Apache. On shared hosting, ask your host to disable TLS 1.0 and 1.1.
apache
SSLProtocol -all +TLSv1.2 +TLSv1.3
Cloudflare
  1. In Cloudflare open SSL/TLS > Edge Certificates.
  2. Set 'Minimum TLS Version' to TLS 1.2.
Copy this
Minimum TLS Version: TLS 1.2

How to check it worked

This should print a 301 status and a Location line starting with https://. Or run our free checkup again.

bash
curl -sI http://example.com | grep -iE '^HTTP|^location'

Common mistakes

  • Redirecting with a temporary (302) redirect. Use 301 so browsers and search engines remember it.
  • Redirecting www and non-www to each other in a loop. Pick one address and send everything there.
  • On Cloudflare, using the 'Flexible' SSL mode. It encrypts only half the trip; use 'Full (strict)' when your server has a certificate.
  • Fixing mixed content on the home page only. Old http:// links often hide in blog posts and product descriptions.

What this can't tell you

HTTPS protects data on the way between the visitor and your server. It says nothing about whether the site itself is safe.

Check your own site, free

The free checkup shows how many results are flagged and how serious. For $1, the report picks the ones that matter for your site and writes each fix for your platform, with your own domain filled in.