How to Redirect Http to Https
How to Redirect HTTP to HTTPS Securing your website with HTTPS is no longer optional—it’s a fundamental requirement for modern web presence. Google has made it clear that sites using HTTP are marked as “Not Secure” in Chrome and other major browsers, which directly impacts user trust, search rankings, and conversion rates. Redirecting HTTP to HTTPS ensures that every visitor, whether they type you
How to Redirect HTTP to HTTPS
Securing your website with HTTPS is no longer optional—it’s a fundamental requirement for modern web presence. Google has made it clear that sites using HTTP are marked as “Not Secure” in Chrome and other major browsers, which directly impacts user trust, search rankings, and conversion rates. Redirecting HTTP to HTTPS ensures that every visitor, whether they type your domain with or without the “s,” is automatically routed to the secure version of your site. This tutorial provides a comprehensive, step-by-step guide to implementing HTTP to HTTPS redirects across multiple server environments, outlines best practices to avoid common pitfalls, recommends essential tools, and includes real-world examples to reinforce understanding. By the end of this guide, you’ll have the knowledge and confidence to implement a flawless, SEO-friendly redirect strategy that enhances security, performance, and search visibility.
Step-by-Step Guide
Redirecting HTTP to HTTPS involves configuring your web server to detect incoming requests on port 80 (HTTP) and automatically send them to port 443 (HTTPS) using a 301 permanent redirect. The exact method depends on your hosting environment, server software, and content management system. Below, we break down the process for the most common configurations.
Apache Server (Using .htaccess)
Apache is one of the most widely used web servers. If your site runs on Apache, the .htaccess file in your root directory is the primary tool for managing redirects.
First, ensure that mod_rewrite is enabled on your server. Most shared hosting providers enable this by default, but if you’re unsure, contact your host or check via phpinfo().
Open your .htaccess file (located in the public_html or www directory) and add the following code at the very top, before any existing rules:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
This code works as follows:
- RewriteEngine On activates the URL rewriting engine.
- RewriteCond %{HTTPS} off checks if the connection is not using HTTPS.
- RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] redirects all traffic to the HTTPS equivalent of the same URL, preserving the full path and query string.
- [L,R=301] means “Last rule” and “Redirect 301” (permanent), which is critical for SEO.
Save the file and upload it back to your server. Test the redirect by visiting your site using http://yourdomain.com. It should automatically redirect to https://yourdomain.com.
Nginx Server
Nginx is known for its speed and efficiency, commonly used by high-traffic sites. Redirecting HTTP to HTTPS in Nginx requires editing the server block configuration file.
Locate your Nginx configuration file. This is typically found at:
- /etc/nginx/nginx.conf
- /etc/nginx/sites-available/default
- /etc/nginx/sites-available/yourdomain.com
Add a separate server block that listens on port 80 and returns a 301 redirect to HTTPS:
server {
listen 80;
server_name yourdomain.com www.yourdomain.com;
return 301 https://$host$request_uri;
}
Then, ensure your main HTTPS server block is properly configured:
server {
listen 443 ssl http2;
server_name yourdomain.com www.yourdomain.com;
ssl_certificate /path/to/your/certificate.crt;
ssl_certificate_key /path/to/your/private.key;
Other SSL settings...
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
root /var/www/html;
index index.html index.php;
Rest of your site configuration...
}
After making changes, test the configuration for syntax errors:
sudo nginx -tIf the test passes, reload Nginx:
sudo systemctl reload nginxVerify the redirect by accessing your site via HTTP. You should be seamlessly redirected to HTTPS.
Microsoft IIS Server
If your site runs on Windows Server with IIS (Internet Information Services), you’ll use the URL Rewrite module.
First, ensure the URL Rewrite module is installed. You can download it from the official Microsoft website if it’s not already present.
Open IIS Manager, select your site, and double-click “URL Rewrite.” Click “Add Rule” and choose “Blank Rule.”
Configure the rule as follows:
- Name: Redirect to HTTPS
- Match URL:
- Requested URL: Matches the Pattern
- Using: Regular Expressions
- Pattern: (.*)
- Conditions:
- Add Condition
- Condition Input: {HTTPS}
- Check if input string: Does Not Match the Pattern
- Pattern: ^ON$
- Action:
- Action Type: Redirect
- Redirect URL: https://{HTTP_HOST}/{R:1}
- Redirect Type: Permanent (301)
Click “Apply” and test the redirect. You can also edit the web.config file directly if preferred. Add this inside the <rules>
<rule name="Redirect to HTTPS" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="^OFF$" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>
</rules>
</rewrite> WordPress users often rely on plugins, but the most reliable method is to configure the redirect at the server level. However, if you must use a plugin, choose a reputable one like “Really Simple SSL” or “SSL Insecure Content Fixer.”
But for best results, avoid plugins and update your WordPress settings directly:
Then, add the Apache or Nginx redirect rules above to ensure all traffic is forced to HTTPS—even if someone accesses your site via a direct IP address or old bookmark.
Additionally, update your .htaccess or Nginx config as described earlier. Some caching plugins (like W3 Total Cache or WP Super Cache) may need to be cleared after making these changes.
If your site uses Cloudflare as a CDN or DNS provider, you can enforce HTTPS at the edge without touching your origin server.
Log in to your Cloudflare dashboard:
Cloudflare will now automatically redirect all HTTP requests to HTTPS before they reach your server. This reduces load on your origin and improves performance.
Important: Even with Cloudflare’s Always Use HTTPS enabled, it’s still recommended to implement server-level redirects as a fallback. This ensures consistency if Cloudflare is ever bypassed or misconfigured.
Many hosted platforms automatically enforce HTTPS. For example:
However, even on these platforms, you should:
While you can’t edit server files on SaaS platforms, you can still audit your site’s internal structure to prevent mixed content issues.
Implementing HTTP to HTTPS redirects is only half the battle. To ensure your site remains secure, fast, and SEO-friendly, follow these essential best practices.
Always use a 301 (permanent) redirect, never a 302 (temporary). Search engines treat 301 redirects as a signal that the HTTPS version is the canonical (preferred) version of your page. This ensures that link equity, rankings, and traffic are fully transferred. A 302 redirect may cause search engines to index both HTTP and HTTPS versions, leading to duplicate content issues.
Don’t just redirect http://yourdomain.com. Redirect all possible variants:
Use a single, consistent canonical version (either www or non-www) and redirect all others to it. This prevents fragmentation of SEO signals.
A redirect chain occurs when a URL redirects through multiple steps before reaching the final destination. Example: http://yourdomain.com → https://yourdomain.com → https://www.yourdomain.com. This adds latency and can confuse crawlers.
Use tools like Screaming Frog or Redirect Mapper to audit your redirect paths. Aim for a single, direct redirect from HTTP to your final HTTPS canonical URL.
A redirect loop happens when a URL redirects back to itself, either directly or through a chain. For example, if your server redirects HTTP to HTTPS, but your HTTPS configuration redirects back to HTTP, you create an infinite loop.
Common causes:
To diagnose, use browser developer tools (Network tab) or online tools like Redirect Checker. A loop will show repeated status codes (e.g., 301 → 301 → 301) until the browser stops it.
After implementing redirects, audit your site for any internal links, images, scripts, or CSS files still pointing to HTTP. These are called “mixed content” issues and can cause browser warnings or broken functionality.
Use browser developer tools (Console tab) to find mixed content warnings. You can also use online scanners like Why No Padlock? or SSL Labs to detect insecure resources.
Replace all instances of Your XML sitemap must reflect HTTPS URLs only. If your sitemap still contains HTTP URLs, search engines may waste crawl budget on deprecated pages.
Submit your updated HTTPS sitemap via Google Search Console and Bing Webmaster Tools. Also, ensure your robots.txt file is accessible via HTTPS and doesn’t block critical resources.
Notify partners, affiliates, or directories where your site is listed (e.g., business directories, social profiles, email signatures) to update links to use HTTPS. While redirects handle most traffic, direct links from high-authority sources improve SEO and reduce potential errors.
HTTPS adds minimal overhead, but misconfigured SSL certificates or slow origin servers can impact load times. Use tools like PageSpeed Insights, GTmetrix, or WebPageTest to monitor performance after the switch.
Enable HTTP/2 or HTTP/3 if supported—these protocols require HTTPS and significantly improve page speed.
HTTP Strict Transport Security (HSTS) is a security header that tells browsers to only connect to your site via HTTPS—even if the user types HTTP. This prevents downgrade attacks and eliminates the need for an initial HTTP redirect.
Add this header to your server configuration:
For Apache, add to your virtual host or .htaccess:
For Nginx, add to your HTTPS server block:
After testing thoroughly, you can submit your domain to the HSTS Preload List at hstspreload.org to ensure browsers globally enforce HTTPS for your site.
Several free and professional tools can assist you in implementing, testing, and monitoring your HTTP to HTTPS redirect strategy.
Let’s examine three real-world scenarios where HTTP to HTTPS redirects were successfully implemented—and what went wrong when they weren’t.
A mid-sized online retailer migrated from HTTP to HTTPS after receiving multiple customer complaints about “Not Secure” warnings during checkout. The team implemented the redirect via Apache .htaccess but forgot to update internal product links that used hardcoded HTTP URLs.
Result: Google Search Console reported over 12,000 mixed content warnings. Browsers blocked images and scripts on product pages, causing a 34% drop in conversions. The issue was resolved by running a full site crawl with Screaming Frog, replacing all HTTP references with HTTPS, and enabling HSTS. Within six weeks, traffic and conversions returned to pre-migration levels, and the site achieved a perfect A+ rating on SSL Labs.
A personal blog used Cloudflare with “Flexible SSL” mode enabled. This setting allowed HTTP traffic to reach the origin server, while Cloudflare served HTTPS to visitors. The site owner added a 301 redirect in .htaccess to force HTTPS, but Cloudflare’s Flexible SSL was still proxying HTTP requests to the origin, causing a redirect loop.
Result: Visitors experienced “Too Many Redirects” errors. The issue was diagnosed using Chrome DevTools, which showed a 301 → 301 → 301 loop. The fix: Switched Cloudflare SSL mode to “Full” and removed the server-side redirect. Cloudflare then handled all redirects at the edge, eliminating the loop and improving performance.
A university department ran a legacy CMS that didn’t support HTTPS natively. The IT team used a reverse proxy to serve HTTPS, but forgot to configure the redirect on the proxy server. As a result, the site was accessible via both HTTP and HTTPS, and Google indexed both versions.
Result: Duplicate content penalties caused organic traffic to drop by 42%. The team used Google Search Console’s “Change of Address” tool to signal the HTTPS migration and implemented a server-level 301 redirect. They also submitted a revised sitemap and manually requested reindexing of key pages. Within three months, rankings recovered, and the HTTP versions were fully deindexed.
No, you don’t need to purchase one. Free SSL certificates from Let’s Encrypt are trusted by all modern browsers and are sufficient for most websites. Paid certificates offer additional features like extended validation (EV) or multi-domain support, but for standard HTTPS redirects, free certificates are perfectly adequate.
When done correctly, redirecting HTTP to HTTPS can improve your SEO. Google uses HTTPS as a ranking signal, and a clean redirect preserves your existing link equity. However, if you use 302 redirects, create redirect chains, or leave mixed content issues, your rankings may temporarily drop. Always test thoroughly before and after implementation.
Google typically crawls and indexes HTTPS versions within days to a few weeks. You can speed up the process by submitting your HTTPS sitemap in Google Search Console and using the “URL Inspection” tool to request indexing of key pages. Monitor the “Coverage” report to ensure no errors occur.
It doesn’t matter which you choose—www or non-www—as long as you pick one and redirect the other permanently. Consistency is key. Most modern sites prefer non-www (e.g., example.com), but both are valid. Use Google Search Console to set your preferred domain and ensure your redirects reflect that choice.
CDNs like Cloudflare, Fastly, or Akamai can handle redirects at the edge, reducing load on your origin server. Configure the redirect in your CDN settings (e.g., Cloudflare’s “Always Use HTTPS”) and disable any conflicting server-side rules to avoid loops. Always test with a tool like Redirect Checker to confirm the redirect path is direct.
Yes. Most shared hosting providers support .htaccess for Apache servers. If you’re unsure, check your hosting documentation or contact support. Many hosts now offer one-click SSL installation and automatic HTTPS redirects.
This usually means your site has mixed content—some resources (images, scripts, iframes) are still loaded over HTTP. Use browser developer tools or Why No Padlock? to identify and fix insecure elements. Also ensure your SSL certificate is valid and not expired.
Yes. In Google Analytics, go to Admin > Property Settings and ensure the default URL uses HTTPS. In Google Tag Manager, check all tags that reference URLs (e.g., Facebook Pixel, custom JavaScript) and update them to HTTPS. Also verify your tracking code is loaded over HTTPS.
Yes. Even static brochure sites, blogs, and portfolios benefit from HTTPS. Google ranks secure sites higher, browsers display trust indicators, and users expect secure connections. There is no longer a valid reason to run a site over HTTP in 2024 and beyond.
Your site will be flagged as “Not Secure” in Chrome and other browsers, which reduces user trust and increases bounce rates. Search engines may demote your site in rankings. You’ll also be vulnerable to man-in-the-middle attacks, data interception, and SEO penalties due to duplicate content between HTTP and HTTPS versions.
Redirecting HTTP to HTTPS is not just a technical task—it’s a critical step in securing your digital presence, building user trust, and maintaining strong search engine performance. Whether you’re managing a small blog or a large enterprise application, the principles remain the same: use 301 redirects, ensure consistency across all variants, eliminate mixed content, and leverage modern security headers like HSTS.
By following the step-by-step instructions outlined in this guide, applying best practices, and using the recommended tools, you can implement a seamless, SEO-friendly redirect strategy that future-proofs your website. Remember, the goal is not just to enable HTTPS, but to ensure every single visitor—regardless of how they arrive—is routed securely and efficiently to your site’s encrypted version.
Don’t delay. If your site is still using HTTP, take action today. The digital landscape is evolving rapidly, and secure websites are no longer a luxury—they’re the baseline expectation. With the right approach, your HTTPS migration will be smooth, invisible to users, and beneficial to your long-term online success. <rewrite>
WordPress Sites
http:// to https://.Cloudflare (CDN-Based Redirect)
Shopify, Wix, Squarespace, and Other SaaS Platforms
Best Practices
Use 301 Redirects, Not 302
Redirect All Variants
Test Redirect Chains
Avoid Redirect Loops
Update Internal Links
http:// with https:// or use protocol-relative URLs (//yourdomain.com/resource) as a temporary fix—though explicit HTTPS is preferred.
Update Sitemaps and Robots.txt
Update External References
Monitor Performance
Set HSTS Header
Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadHeader always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;Tools and Resources
Redirect Checkers
SSL Certificate Validators
SEO and Crawling Tools
Server Configuration Helpers
Online Validators for Mixed Content
Documentation and References
Real Examples
Example 1: E-commerce Site Migration
Example 2: Blog with Cloudflare Misconfiguration
Example 3: Corporate Website with Legacy CMS
FAQs
Do I need to buy an SSL certificate to redirect HTTP to HTTPS?
Will redirecting HTTP to HTTPS affect my SEO rankings?
How long does it take for Google to recognize my HTTPS site after the redirect?
Should I redirect www to non-www or vice versa?
What if my site uses a CDN or proxy service?
Can I redirect HTTP to HTTPS on a shared hosting plan?
Why do I still see “Not Secure” after implementing HTTPS?
Do I need to update my Google Analytics and Google Tag Manager?
Is HTTPS required for all types of websites?
What happens if I don’t redirect HTTP to HTTPS?
Conclusion
