How to Migrate from HTTP to HTTPS

1. Get SSL certificate. sudo certbot --nginx -d example.com -d www.example.com. Free from Let's Encrypt.
2. Configure HTTPS in web server. nginx: 443 server block with ssl_certificate + ssl_protocols TLSv1.2 TLSv1.3;
3. 301 redirect from HTTP to HTTPS. Separate 80 server block: return 301 https://$host$request_uri;
4. Fix Mixed Content. Replace all http:// links with https:// or // (protocol-relative). Check via /en/mixed-content.
5. Update canonical and sitemap. In sitemap.xml and <link rel="canonical"> — only https URLs.
6. Enable HSTS. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
7. Submit to hstspreload.org. To be added to Chrome's preload list. Protection against downgrade on first visit.
8. Google Search Console. Add the HTTPS version as a separate property. Confirm 301 redirects from HTTP.

Open tool →

Before migrating your site from HTTP to HTTPS, it's crucial to understand SSL/TLS certificates. These certificates encrypt the data between the user's browser and your web server, ensuring secure transmission of sensitive information.

To obtain an SSL certificate, you can use certbot, which automates the process for you. Below are the steps to acquire and install a free SSL certificate using certbot:

• Install Certbot: Depending on your operating system, you can install certbot with the following commands:
sudo apt-get install certbot python3-certbot-nginx or sudo apt-get install certbot python3-certbot-apache

After installing certbot, you can obtain your SSL certificate:

Follow the prompts to set up your certificate. Certbot will automatically configure your web server to use HTTPS, but it's essential to review and adjust the configurations if necessary.

Once you've migrated your site to HTTPS, testing your configuration is essential to ensure everything is functioning correctly. You can utilize various tools and commands to check the security of your HTTPS setup.

One effective method is using the SSL Labs SSL Test. This online tool analyzes your SSL configuration and provides a grade based on various factors, including certificate validity, protocol support, and security vulnerabilities. Simply visit SSL Labs SSL Test and enter your domain name to get started.

Another useful command-line tool is curl. You can test your HTTPS configuration by running:

This command returns the HTTP headers, allowing you to check if your server properly responds to HTTPS requests and if the correct headers are being sent. Look for the HTTP/2 200 or HTTP/1.1 200 OK response.

Additionally, ensure that your site is not serving mixed content by using the browser's developer tools. Check the console for any mixed content warnings, which indicate that some resources are still being loaded over HTTP.

After migrating to HTTPS, it's important to update all internal links and resources on your site to ensure a seamless user experience. Failing to do so can lead to mixed content issues, where secure and non-secure content is served together.

Start by scanning your website for any remaining HTTP links. You can use tools like grep in the command line to find links in your HTML files:

This command will list all instances of HTTP links. Once identified, you can replace them with HTTPS links. If your site uses a Content Management System (CMS) like WordPress, you can utilize plugins like Better Search Replace to automate this process.

Additionally, check your database for any stored URLs that may still point to HTTP. For example, in WordPress, you can run the following SQL query to update your site URL:

After updating your internal links, clear your browser cache and test your site thoroughly to ensure all resources load securely via HTTPS.