HTTPS & cookies

How to fix: HTTPS and SSL certificate

HTTPS encrypts traffic between your visitors and your server. It needs a valid certificate for your exact hostname and a redirect so nobody stays on plain HTTP.

Not sure whether your site has this problem? Check it in seconds.

SSL Checker Run a free audit

Why it matters

Without HTTPS, anyone on the network path can read or alter what your visitors send and receive. Browsers also label HTTP pages 'Not secure', and an expired certificate shows a full-page warning that most visitors won't click through.

How to check

Visit http://yourdomain.com: it should redirect to https:// automatically. Click the padlock to check the certificate's expiry date and the hostname it covers, or use our SSL checker.

How to fix it

Nginx redirect

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

Apache redirect

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Let's Encrypt renewal test

sudo certbot renew --dry-run

Common mistakes

Relying on a certificate that renews manually and forgetting. Automate renewal and monitor the expiry date.
A certificate that covers example.com but not www.example.com (or the reverse): visitors on the uncovered name see a warning.
Redirecting to HTTPS but leaving http:// links in your pages, which causes mixed-content warnings.

Frequently asked questions

Hosting on Vercel, Netlify or Cloudflare?

They issue and renew certificates and redirect HTTP to HTTPS automatically for custom domains once DNS is set correctly, so a failing check usually means a DNS or domain-configuration issue.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.