How to move a site from HTTP to HTTPS

Before you start

• Hosting with certificate support
• Access to the site code or database
• Search Console access

The steps

1. 1

   Step 1: Install a certificate

   Free through Let’s Encrypt on almost every host. Enable automatic renewal at the same time.

2. 2

   Step 2: Find mixed content

   Search templates and the database for http:// references. The browser console lists any that remain.

3. 3

   Step 3: Update internal references

   Links, images, scripts and stylesheets to protocol-relative or https:// URLs.

4. 4

   Step 4: Redirect HTTP to HTTPS

   One hop, at the server level, covering both www and non-www.

5. 5

   Step 5: Update canonicals and sitemaps

   Every canonical, Open Graph URL and sitemap entry to the HTTPS version.

6. 6

   Step 6: Add the HTTPS property

   In Search Console, and submit the sitemap again.

7. 7

   Step 7: Enable HSTS

   Start with a short max-age, verify nothing breaks, then increase it.

Why the redirect must be one hop

http://example.com → https://example.com → https://www.example.com is three requests before the page loads, and each hop dilutes signal. Configure the destination directly rather than chaining rules.

The failure that takes a site offline

An expired certificate produces a full-page browser interstitial stopping every visitor. Automate renewal and monitor it — this is one of the most common ways a small business site goes dark for days without anyone noticing.

What to check the day after

Search Console coverage for a spike in errors, your analytics for a referral traffic drop, and any hardcoded HTTP links in email templates or PDFs you have distributed. Also check embedded content — a map or a video loaded over HTTP is blocked entirely on an HTTPS page rather than degrading gracefully, so a page can look correct in your browser cache and broken to a first-time visitor.

The background behind this

Technical SEO, in the order the problems actually block you covers the reasoning in about 4 minutes — free, ungated, written from client work.

Who wrote this

Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada, Ireland and Pakistan. These procedures are the ones I run on client work, written down rather than invented — including the ones where the honest answer is that the fix is not available on your current hosting.