Guide
How to move a website from HTTP to HTTPS safely
You move a site to HTTPS by installing an SSL certificate, redirecting every HTTP address to its HTTPS equivalent with a permanent redirect, fixing any content that still loads over HTTP and updating your sitemap and Search Console. Done in that order, the move keeps your rankings and removes the browser warning. Free SSL is included on every plan with us.
Overview
The move in five stages
- CertificateTurn on SSL for the domain
- Site addressSwitch the site URL to https
- RedirectsSend every HTTP page to HTTPS
- Mixed contentFix images and scripts on HTTP
- Tell searchUpdate sitemap and Search Console
Why
Why HTTPS matters, in brief
HTTPS encrypts the connection between a visitor and your site. Browsers show a padlock for it and warn about pages without it. Search engines treat it as a light ranking signal and prefer to show the secure version of a page.
For a business site it is also a matter of trust. Visitors who see a "not secure" warning are less likely to fill in a form, call or buy. HTTPS is included free with our hosting, so there is no reason to delay. Our page on free SSL certificates explains what you get.
Step by step
The move itself
Install the certificate
Enable SSL for your domain in the control panel and check that https loads without a warning.
Change the site address
In WordPress, change the home and site address in settings to https. Take a backup first.
Add a permanent redirect
Send all HTTP requests to HTTPS with a 301 redirect, so old links and search results arrive at the secure page.
Fix mixed content
Update images, scripts and fonts still loaded over HTTP, until the padlock is clean on every page.
Update the details
Change canonical tags, your sitemap and internal links to HTTPS, and add the HTTPS site in Search Console.
Worked example
A local business switches to HTTPS in an evening
A small building firm has a ten-page WordPress site that still loads over HTTP. The owner notices browsers calling it "not secure" and decides to fix it. The site is on our hosting, so SSL is already available.
After a backup, the owner enables SSL for the domain and checks that the secure address loads. In WordPress settings the home and site address are changed to https. A redirect rule sends every HTTP request to HTTPS. A quick look at a few pages shows two images still load over HTTP, so the owner replaces those links.
The sitemap is regenerated with the secure addresses, and the owner adds the HTTPS site to Search Console. Within a week the coverage report shows the pages indexed on HTTPS, and the "not secure" warning has gone. The whole job took about ninety minutes.
Troubleshooting
If something looks wrong after the move
A redirect loop usually means two things are redirecting at once, such as a plugin and a server rule. Switch one off and test. A site that looks unstyled usually has stylesheets still loading over HTTP, which the browser blocks.
If a payment or booking widget stops working, check that its settings use the HTTPS address for the site. Some services store the old HTTP address and need updating. Finally, remember that browsers and search engines cache old results, so test in a private window and give search results a little time to update.
- Redirect loop: disable duplicate redirects
- Unstyled page: update the stylesheet address to https
- Widget not working: update the stored site address
- Warning on one page: look for an HTTP image or script on that page
- Old address still in search results: wait for recrawling and check your sitemap
Looking ahead
Keeping HTTPS healthy
Once you are on HTTPS, keep it healthy. Certificates expire, so confirm that renewals are automatic. Make sure new content uses HTTPS links, and that every new service you add, such as a form or a map, loads securely.
Check the security tab in your browser from time to time, and keep your Search Console property for the HTTPS version under review. A small routine like this prevents the slow return of warnings.
Other tools
Do not forget the places that link to you
After the move, update the addresses you control elsewhere: your Google Business Profile, social media profiles, email signatures, directory listings and any advertising. Most will redirect, but linking straight to the HTTPS address saves a step and keeps your analytics clean.
Also check third-party tools that store your website address, such as email marketing, booking and review services. Some keep the old HTTP address and may stop working correctly until it is updated.
A short list, written down once, makes this a ten-minute job. Add a note of every place your address appears, and tick them off as you update each one.
One last check
Test the whole journey, not only the pages
Finish by walking through a real visitor journey on your phone: arrive from a search result, read a page, fill in a form and complete any purchase or booking. Every step should stay on HTTPS with a clean padlock, and nothing should send you back to an insecure address.
Free SSL on every plan
Turn on HTTPS and keep your visitors safe.
Redirects
Getting the redirect right
A 301 redirect tells browsers and search engines that a page has moved permanently. For an HTTPS move, every HTTP address should redirect to the same path on HTTPS, in a single step, and not through a chain of redirects.
Test a few pages, including deep ones, with and without www. Each should end on one HTTPS address. A redirect loop, where pages keep bouncing between two addresses, is usually a sign that two plugins or rules are both trying to redirect.
For WordPress, a simple plugin or a rule in your configuration will do it. If you are unsure, ask our live chat to check your rules.
Mixed content
Finding and fixing mixed content
| Symptom | Cause | Fix |
|---|---|---|
| Padlock with a warning | An image or script loads over HTTP | Change its address to HTTPS |
| Missing images | The browser blocks insecure files | Update image links or re-upload |
| Styles look broken | A stylesheet is blocked | Update the stylesheet address |
| A form fails | It posts to an HTTP address | Change the form action to HTTPS |
| An embedded video does not show | The embed uses HTTP | Use the HTTPS embed code |
Your browser's developer tools list every insecure request on a page under the console or security tabs.
After the move
Final checks
- Every page shows a clean padlock
- HTTP addresses redirect to HTTPS in one step
- The www and non-www versions both end on one address
- Canonical tags use the HTTPS address
- The sitemap lists HTTPS addresses
- Search Console has the HTTPS property added
- Analytics and ad tags use the HTTPS site
- Social profiles and listings link to HTTPS
Search
What to expect in Google
You may see small fluctuations for a few days or weeks while search engines recrawl your pages. With correct permanent redirects and consistent signals, rankings normally recover fully and sometimes improve slightly.
Keep the HTTP version redirecting for the long term. Do not remove the redirects, because old links and bookmarks will keep arriving for years. Watch the coverage and security reports in Search Console for errors in the first month.
FAQ
Common questions
Will moving to HTTPS hurt my rankings?
Not if you use permanent redirects and update your links and sitemap. Short-lived changes are normal.
Is HTTPS free with you?
Yes. Free SSL certificates are included on every plan.
What is mixed content?
A secure page that loads some files over HTTP. Browsers may block them or show a warning.
Do I need to renew the certificate?
Certificates expire and must be renewed. On our plans they are managed for you.
Should I use www or not?
Either works. Choose one, redirect the other to it, and be consistent.
Keep reading
Related pages
Put your site on HTTPS today
Free SSL on every plan, with a 15-day money-back guarantee.