How to Move Your Site to HTTPS

What this means

HTTPS is the secure version of a web address. It needs an SSL certificate, a small file your web host installs, which proves the site is yours and encrypts what visitors send.

A site audit can find four related problems:

• No https at all. Browsers label the site "Not secure".
• An invalid certificate. It has expired, or it doesn't cover the address visitors use (for example, it covers www but not the version without www).
• http doesn't redirect to https. Both versions of the site load, side by side.
• Links to http addresses. A secure page links to insecure ones.

Why it matters

A browser warning is the fastest way to lose a visitor. An expired certificate is worse than none: visitors get a full-page warning before your site even loads.

Google also prefers secure pages, and two versions of your site (http and https) split the ranking strength between them.

How to fix it

Turn on a certificate

Most hosts include a free certificate, usually from Let's Encrypt, and renew it for you. Look in your hosting control panel for "SSL", "TLS" or "Security" and switch it on for every version of your address.

Shopify, Wix, Squarespace and most hosted site builders add and renew certificates by themselves. If yours shows an error, the usual cause is a domain that was connected recently, or DNS records that point somewhere else. Their support team can check it in minutes.

Fix an invalid certificate

1. Check the expiry date by clicking the padlock (or warning sign) in your browser's address bar.
2. If it has expired, renew it in your hosting panel, or ask your host why automatic renewal stopped.
3. If it's valid but doesn't cover www (or the bare domain), reissue it to include both.

Redirect http to https

Every http address should send visitors to the same page on https with a permanent (301) redirect. Many hosts have a "Force HTTPS" switch. On WordPress, plugins such as Really Simple SSL do it, or your host can add one rule to the .htaccess file.

Type http://yoursite.com into a browser afterwards. It should land on https by itself.

Update old http links

Open the pages listed and change any link that starts with http:// to https://. Most sites support https at the same address, so the link usually works straight away. Check it opens before you save.

If a link points to another site that has no https version, decide whether you still need it.

Checking your fix

Reload your site and look for the padlock. For links, open each page and check the old addresses have gone.

If you use Duality, tick the pages in Site Audit and choose Verify my fixes to re-check links straight away. Certificate and redirect checks look at the whole site, so the next monthly audit confirms them.