Published: 24.06.2026
Browsers mark sites without encryption as not secure, and search engines prefer HTTPS. Switching is easy, but a careless move can lead to duplicate pages, broken images and lost traffic. Follow this order and the change will be invisible to visitors.
Why HTTPS matters
- It encrypts the connection, which protects passwords and personal data.
- It proves that visitors reach your real site, not a copy.
- Browsers show a warning on pages that collect data over plain HTTP.
- Modern features, such as HTTP/2 and many browser APIs, work only over HTTPS.
- Search engines use HTTPS as a small ranking signal and show it to users as a mark of trust.
Step 1: Get and install a certificate
A free domain-validated certificate is enough for most sites. Many control panels issue and renew it automatically. Make sure the certificate covers both the main name and the www version, and include any subdomains you use.
Step 2: Check that HTTPS works
Open the site by https:// and look for the padlock. Fix mixed content, which means images, scripts or styles that are still loaded over HTTP. Browsers block or warn about them. Search the page code for http:// links and replace them with https:// or relative addresses.
Step 3: Update the site address
In the settings of your platform, change the site address to https. In WordPress this is the site address and the WordPress address. Update hard-coded addresses in the database with a safe search-and-replace tool.
Step 4: Set up 301 redirects
Redirect every HTTP address to its HTTPS twin with a permanent 301 redirect. Keep the path the same: http://example.com/page should go to https://example.com/page. Choose one preferred version, with or without www, and redirect the other to it, so that only one address remains.
Step 5: Update the signals for search engines
- Set canonical links to the HTTPS addresses.
- Update the sitemap and the robots file.
- Add the HTTPS version as a property in the search console and submit the new sitemap.
- Update links in your profiles, advertising and e-mail signatures.
Step 6: Enable HSTS
HSTS tells browsers to always use HTTPS for your domain. Start with a short period, test, and then increase it. Be careful with the subdomain option and with preloading, because they are hard to undo.
Common mistakes
- Redirect chains, where one address redirects several times before the final page.
- Redirects to the home page instead of the same page on HTTPS.
- Expired certificates, which cause a full-screen warning.
- Forgotten subdomains and images on other hosts that still use HTTP.
- Blocking the old HTTP site in robots so that search engines cannot see the redirects.
Check the result
Test several types of pages: the home page, a post, a category and the checkout. Use an online SSL checker to look at the chain, and a crawler to look for remaining HTTP links. Watch the search console for errors over the next weeks.
Frequently asked questions
Will my rankings drop? A correct move with 301 redirects normally causes at most a short fluctuation.
Do I need a paid certificate? Not for most sites. Choose an organisation-validated certificate only if your business requires it.
How often must I renew? Free certificates last about ninety days, but renewal is automatic with the right tools.
