HTTPS means that communication between the browser and the website is encrypted. In the address bar you recognize it by the padlock and an address starting with https://. It is provided by an SSL/TLS certificate, which confirms that the website belongs to you. A general explanation is under the term SSL certificate.
Why you need HTTPS
- It protects login details, forms and payments from eavesdropping.
- Browsers label websites without HTTPS as not secure, which puts visitors off.
- Search engines prefer HTTPS.
- Many newer browser features work only on secure pages.
How to get HTTPS working
- Get a certificate. On our hosting you can use your own certificate. Ask us whether automatic issuing of a free certificate is also available for your website: write to us.
- Install the certificate for your domain in the website settings of the admin panel, or we can help you with it.
- Redirect the website from http to https, see Redirects and the .htaccess file.
- Change the website address in your application. In WordPress, go to Settings > General and change both addresses to https.
- Fix mixed content.
Mixed content
If a page on https loads images, scripts or styles over http, the browser blocks some of them and the padlock disappears. Causes:
- Texts and templates contain links hard-coded with http://. Replace them with https:// or with links without a domain (starting with a slash).
- Content is loaded from a third-party server that does not offer https. Find a replacement.
In WordPress, it helps to replace old addresses in the database with a suitable search-and-replace plugin. Do not do a plain replacement directly in SQL, as it risks corrupting the stored data.
How to check it
- Open the website in a browser. The address must show a padlock without a warning.
- Check that an http:// address changes to https:// on its own.
- Keep an eye on the certificate's validity. After it expires, visitors see a warning and the website is practically unavailable.