Security
Serve the padlock version of your site everywhere
Your site answers on a plain http address, so the browser tells visitors the connection is not secure.
Why it matters
Browsers now label any page served over plain http as Not secure, in the address bar, before a visitor reads a word of your content. Most people leave at that point and they do not come back to tell you why. Search engines also rank the secure version of a page above the plain one, so this costs you the visit twice: once at the browser warning and again in search results.
How you would notice it
- The address bar shows Not secure on at least some pages.
- The site loads when you type https at the front but not when you click an old http link.
- Links from old emails, invoices, or printed material behave differently from links on your own site.
What to do
Stage 1
- Confirm a certificate exists before buying anything. Ask your host, or check their control panel, for a free certificate such as Lets Encrypt. Most hosts now include one with a single click.
If a padlock already appears when you load the site over https, you have a certificate and the remaining steps are only about the redirect.
- Once the certificate is installed, load your site with https at the front and confirm the padlock appears.
Check the exact name people type. A certificate issued for www.example.com does not cover example.com, so the bare name may still warn.
https://www.example.com/Stage 2
- Send every plain http request to the secure version, so no visitor can land on the unsafe one.
If your host offers a setting named Force HTTPS or Always use HTTPS, turn that on instead. It achieves the same thing without a config file.
# nginx
server {
listen 80;
server_name example.com www.example.com;
return 301 https://www.example.com$request_uri;
}Stage 3
- Update the links you control, including directory listings and advertising, so visitors arrive on the secure address directly rather than through a redirect.
How to check it worked
Confirm it worked
Type your address with http at the front, then press enter. The browser should land on the https version with a padlock showing, and the insecure address should not load on its own. Re-run the Siege Test and confirm the HTTPS check turns green.