Put your site on HTTPS
Install a free TLS certificate and serve every page over HTTPS.
20 min
why this matters
Browsers label plain HTTP pages as 'Not secure'. Shoppers abandon carts on that warning alone, and Google demotes insecure pages in search.
Step by step
- 1
Check whether your host already offers it
Most managed hosts, Cloudflare, Netlify, Vercel and cPanel include free certificates with a single toggle. Look for 'SSL', 'TLS' or 'HTTPS' in your hosting dashboard and switch it on before doing anything manual.
- 2
Or issue a free Let's Encrypt certificate
On your own server, Certbot obtains and installs the certificate and edits your web server config for you. Run it for both the root domain and www.
sudo apt install certbot python3-certbot-nginx sudo certbot --nginx -d example.com -d www.example.com - 3
Confirm automatic renewal
Certificates last 90 days. Certbot installs a renewal timer — test it so you never wake up to an expired certificate.
sudo certbot renew --dry-run - 4
Fix mixed content
Search your templates and CSS for http:// asset URLs and change them to https:// or protocol-relative paths, otherwise the padlock stays broken.
how to check it worked
- https://example.com loads with a padlock and no warning
- The browser console shows no mixed-content errors
- The certificate expiry date is at least a month away
related guides
Fix a site that isn't responding
None of the four common addresses for your domain returned a working page. Work through DNS, then the server, then the firewall.
Redirect HTTP traffic to HTTPS
Send every insecure request to the secure version with a permanent 301 redirect.
Pick one canonical hostname
Serve your site from a single address and redirect all the others to it.
Cut your server response time
Get time-to-first-byte under 500ms with caching and a CDN.