Once the SSL certificate has been installed, the website is also accessible via HTTPS, but the old http:// address will continue to work. To ensure that all visitors and search engines are directed to the encrypted version, HTTP requests must be redirected to HTTPS using a 301 (permanent) redirect.

Why is this important?

• Security: Over HTTP, passwords, form data and cookies are transmitted over the network in plain text.
• Browsers: Chrome and other browsers mark HTTP pages as ‘Not secure’, which deters visitors.
• Search engines: Google has been taking HTTPS into account as a ranking factor since 2014, and content available on both versions simultaneously is considered duplicate content. A 301 redirect also transfers the rankings of the old URLs to the new ones.

Option 1: cPanel

On cPanel hosting, the easiest option is the built-in toggle:

1. Log in to cPanel and open the ‘Domains’ menu item.
2. Toggle on the ‘Force HTTPS Redirect’ switch in the domain row.

The switch is only active if a valid certificate has already been installed for the domain.

Option 2: .htaccess

On an Apache or LiteSpeed web server, add the following to the top of the .htaccess file (in the website’s root directory):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

If you also want to redirect visitors to the address without www, you can handle both with a single rule:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

After saving, open the page in a private browser window, as your browser remembers previous redirects.

Option 3: Nginx (own VPS)

server {
    listen 80;
    listen [::]:80;
    server_name pelda.hu www.pelda.hu;
    return 301 https://pelda.hu$request_uri;
}

WordPress

In WordPress, on the Settings > General page, change both the WordPress Address and the Site Address fields to start with https://, then replace the old internal links starting with http:// in the database (for example, using the WP-CLI command wp search-replace 'http://pelda.hu' 'https://pelda.hu' or a search-and-replace plugin). Otherwise, the page will load via HTTPS, but some of the images and scripts will be served via HTTP.

Common errors

• Too many redirects (ERR_TOO_MANY_REDIRECTS): this often occurs behind Cloudflare in ‘Flexible’ SSL mode, because the request arrives at the hosting server via HTTP and the rule redirects it over and over again. Set Cloudflare to ‘Full (strict)’ mode; see the article on Cloudflare’s SSL modes.
• A warning appears next to the padlock: some elements of the page are still loading via HTTP. This is a ‘mixed content’ error.

If all pages are working correctly over HTTPS, the next step is to enable HSTS. If you get stuck, please open a ticket on the client portal and we’ll help you.