Forcing HTTPS and HSTS: making sure visitors always get the secure version

The short version

Redirecting HTTP to HTTPS

When a browser is given a bare address like yourbusiness.co.uk, it often tries plain HTTP first. Your server should answer that first request with "go to the HTTPS version instead" — a 301 redirect. Without it, the visitor stays on the insecure version, sees "Not secure" in the address bar, and every form they fill in travels unencrypted.

This is one of the most common gaps we find: the certificate is perfectly valid, but nothing forces its use. On cPanel hosting, there is usually a "Force HTTPS Redirect" toggle in the Domains section. Otherwise, add this near the top of your .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Cloudflare, switch on Always Use HTTPS under SSL/TLS → Edge Certificates.

HSTS: telling the browser to never ask again

A redirect fixes the problem after the first insecure request — but that first request still happens, and on a hostile network (public Wi-Fi, say) that one moment is enough for an attacker to intercept and hijack the connection before the redirect arrives. This is called an SSL-stripping attack.

HSTS (HTTP Strict Transport Security) is a header your site sends that tells the browser: "for the next year, only ever connect to me over HTTPS — do not even try HTTP." After the first visit, the browser upgrades every request itself before it leaves the device, so there is no insecure first request to attack.

The header looks like this, and should be sent on every HTTPS response:

Strict-Transport-Security: max-age=31536000; includeSubDomains

max-age=31536000 is one year in seconds — we flag anything under six months as too short. includeSubDomains extends the protection to www., shop. and so on. On Apache/LiteSpeed add Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" to .htaccess; on Cloudflare it is a toggle under SSL/TLS → Edge Certificates.

A note of caution: HSTS is a promise. Only enable it once you are confident HTTPS works on your whole site and all subdomains, because once a browser has seen the header it will refuse plain HTTP for the full duration.

Mixed content: the secure page with insecure parts

Your page loads over HTTPS, but one of the images, scripts or stylesheets on it is still referenced with an http:// address. That is mixed content. Browsers treat it in two ways: insecure *images* produce a downgraded padlock or a "Not fully secure" warning; insecure *scripts and stylesheets* are blocked outright, which can break how the page looks or works.

It usually comes from old content: images pasted into blog posts years ago, a theme hard-coded with http:// links, or an embedded widget. The fix is to change those references to https:// (or protocol-relative //). On WordPress, a search-and-replace plugin such as Better Search Replace can swap http://yourdomain for https://yourdomain across the whole database in one go. Then set the Site Address in Settings → General to the https:// version.

VigilScan scans your homepage for http:// resources and lists examples so you can find them quickly.

Common questions