Learning how to move your website to HTTPS is an important topic. These days, we share sensitive data like credit card and banking information or login credentials dozens of times per day.
Using the web to go shopping gives us many conveniences. We no longer need to go out to run errands, buy groceries, pay bills, or talk face-to-face with others. Hell, right before I wrote this guide, I was trying on glasses online!
Plus, you no longer have to inadvertently use a damaged ATM to have your credit card information stolen. This is also now possible in the comfort of your own home. No extra cost!
However, there is an opposite side. As a website owner, especially if you run an online store and/or deal with financial or other information, you have a responsibility to keep it safe. One of the most important steps in doing this is to use HTTPS and SSL encryption on your site. That’s what we’ll talk about in this guide.
We will first talk about what we understand by HTTPS and SSL and how it works. After that, we’ll talk about the reasons to add encryption to your site. We’ll then tell you where you can get an SSL certificate for your site, and finally we’ll provide a step-by-step guide on how to move your site to HTTPS.
Ready? Then put on your safety glasses and let’s talk a little about safety.
Click here for 8 steps to move your WordPress to https: //
How HTTPS Works – A Short Definition
Before we delve into how to move your website to HTTPS, let’s first define what we’re talking about. Even if you don’t know exactly what HTTPS and SSL are, you’ve probably seen them before at work.
HTTPS and SSL are visible in the site URLs
In this
These days, the URL of most large sites (and increasingly smaller ones as well) start with https: // en lugar de la familiar http: // . In fact, if you look at your browser bar while you’re on this very website, you’ll see exactly that.
Next to it, you will also notice the padlock symbol. This is how modern browsers show that you are on a site that uses SSL encryption. In some cases, they even include the name of the company. Both are signs that you are on a site that takes the privacy of its visitors seriously.
What does that really mean?
HTTPS means secure hypertext transport protocol. Its cousin, HTTP (which means the same minus the secure end), is the communication protocol that is generally used to facilitate web traffic.
What is the difference?
The secure version uses a Secure Socket Layer (SSL) certificate to establish a connection between the browser and the server. That means that any information that is exchanged is encrypted.
By Munkhzaya Ganbold (Own work)[ CC BY-SA 4.0 ], a via Wikimedia Commons
Encryption is the process of replacing plain text information (such as usernames and passwords) with random numbers and letters. That way, they are no longer readable by humans and harder to understand if someone intercepts them.
Sounds useful, right? But do you really need it on your site? Let’s review some good reasons to add HTTPS to your WordPress website.
A quick note: Technically SSL is no longer the correct name. In the late 1990s, the name changed to TLS (Transport Layer Security) and SSL was retired. However, his name stuck around.
Why should you move your website to HTTPS?
Nowadays, only 0.1% of all websites use SSL . Consequently, it doesn’t seem like technology is essential to running a successful web presence. However, there are still compelling reasons to become part of the minority.
1. Your site handles sensitive information
First of all, if you have an online store that handles credit card information or similar sensitive data, moving your site to HTTPS is an absolute must. Customers want to trust your site and they should be able to. It is your responsibility to make that happen.
For example, if someone uses a public Wi-Fi hotspot to access an unsecured site, others can steal your payment details. If they use that information to steal from your customer, how likely do you think that person will come back to your site? Not much.
Without HTTPS it is also possible to modify the data your visitors receive. That way, a third party could add ads, malware, or other things that you definitely don’t want others to see on your web presence.
In fact, a while ago AT&T got caught doing that (add ads, not malware). However, you can be sure that visitors will not really care who did the deed. Everyone will remember what happened on your site.
However, even if you’re “just” dealing with normal login information, it’s not a bad idea to offer an extra layer of security and keep it safe. Your users will surely appreciate it.
2. HTTPS is a sign of trust and authenticity.
Speaking of visitors: Due to the general momentum of adapting HTTPS on the web, encryption has become something consumers expect more and more. In fact, until now the 28.9% look at the green address bar in your browser, a number that will likely increase over time.
Why do you care? Because the little padlock not only means that your traffic is protected, but also that the website is authentic and who it claims to be, is not fake. After all, the same study shows that 77% of end users are concerned about interception and misuse of their data.
So if they are given the choice between your site without HTTPS and a competitor who has implemented it, there’s a good chance they’ll decide against you. Especially since the major browsers ( Chrome , Firefox ) now they mark sites, which have forms on pages without HTTPS, as insecure.
In the future, they can generally warn you of any site that does not have encryption. And you really don’t want to be among those.
3. Benefits for SEO
Not only are consumers expecting you to move to HTTPS, but so are search engines. Google officially announced that having an SSL certificate in place is now a ranking factor. Also, although it is weak at the moment, the importance of HTTPS will increase over time.
On top of that, HTTPS to HTTP referral data is blocked in Google Analytics. So if you have a website running on the old protocol and you get a lot of referrals from sites running on HTTPS, you won’t see it correctly in your web analytics. That way, you may not be aware of the platforms that send you a lot of traffic and lose amplification of your marketing channels.
4. Faster loading times
Staying on the subject of SEO, HTTPS is also significantly faster. Don’t believe me Try it here (use a private window to avoid image caching). When I tested, HTTPS was 83% faster!
Not bad, right? Especially because the Page load speed is also a ranking factor.
Not only that, but visitors care. In fact, a large part will leave their site if it doesn’t charge in three seconds. For that and other reasons, check out our guide on how to speed up wordpress
8 steps to move your WordPress site to HTTPS
Ok, now we’re getting to the meat and potatoes of this article: how to move your site from HTTP to HTTPS. We will take this step by step to make sure you can follow it without problems. After all, we care about the security of your site too!
1. Backup of your website
Whenever you make any major changes to your site, you should always back it up first. That way, in case something goes wrong (not that we’re expecting it), you can roll back to the working version.
Since this case is no different, backing up your website is your first task. Even better: If you have the chance, run the process below on a test server first, not just your live site.
2. Deploy your SSL certificate
The first thing we will do is get an SSL certificate. How easy or complicated this process is depends largely on your host.
For example, while researching this guide, I discovered that my current host doesn’t support Let’s Encrypt and doesn’t plan on doing so. Needless to say, I am in the process of changing. Hopefully yours is a bit more progressive, like the companies in this list .
The optimal scenario is that your host offers an option to move your site to HTTPS directly in the admin panel. For example, to switch your site to Let’s Encrypt in cPanel, you can follow these instructions . Find the same steps for Plesk here.
For everyone else, there Certbot . If you have administrative administrator access on your server, you can simply select the type of web server and operating system you are using. After that, the site will tell you how to implement Let’s Encrypt on your server.
If you get your SSL certificate from a different source, follow your hosting provider’s instructions for implementing the change (that’s also why using them in the first place isn’t a bad idea).
Once this is done, you need to start making the necessary changes to your WordPress website. This is what we will talk about next. If you find the following too technical, you can also try the plugin Really Simple SSL . It handles most of the heavy lifting described below.
3. Add HTTPS to WordPress admin area
The first place where you will be able to enjoy the new secure connection is the WordPress dashboard. By securing the back end first, you ensure that every time a user logs in, their information is exchanged securely.
To do so, open wp-config.php in your WordPress root folder and add the following line somewhere before it says That’s it, stop editing! .
define ('FORCE_SSL_ADMIN', verdadero);
Once you’ve updated the file, it’s time to test if it works. For that, try to access your login page with HTTPS in the URL, for example via https://yoursite.com/wp-admin . If everything worked fine, you should now have a secure connection. then continue.
4. Update site address
After moving the WordPress backend to HTTPS, it’s time to do the same for the rest of your site. You can do this by updating your site address at Settings > General.
Add https: // at the beginning of the WordPress address and the site address. Then update your settings by saving. Please note that you may need to sign in again later.
5. Change links in your content and templates
Now is the time to update any links in your content and database that include the old HTTP protocol. A plugin like Velvet Blues or the search and replace script can help with that. However, be careful! If handled incorrectly, they can also ruin your site. Good thing you made that backup earlier, right?
If you have links to resources and external resources in your theme templates and feature files with absolute HTTP links, it’s important to fix those as well. Things to consider:
- Images, videos, audio hosted on your site.
- web fonts
- iframes
- JavaScript Files or CSS or assets referenced within those files
- internal links
If possible, change your links to en //lugar de https://. Then they themselves will create relative links!
6. Implement 301 Redirects in .htaccess
The next step in moving your site to HTTPS is to set up a redirect that automatically sends visitors to the secure version. For that, we will use .htaccess. This is the name of an important system file on your server (usually in the WordPress root directory).
It usually contains settings to use nice permalinks, so your installation probably already has one. To find it, make sure you allow your FTP client to show hidden files because .htaccess it is invisible by default. If you don’t have one, just create a plain text file, rename it .htaccess and upload it to the WordPress root directory.
After that, add the following lines to it:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond% {HTTPS} desactivado
RewriteRule ^ (. *) $ Https: //% {HTTP_HOST}% {REQUEST_URI} [L, R = 301]
</IfModule>
That’s it. From now on, visitors (including Google bots) should automatically log into the HTTPS version of your WordPress site. Make sure there are no pages available in both versions. This can lead to problems with duplicate content. Not good for SEO.
7. Try and live
Ok, now that we’re done with the main steps, it’s time to test if everything works correctly. For that, go to SSL Test . Insert your domain name and click Send . This will give you an overall score on how well you’ve implemented SSL on your site and the details to uncover potential issues in order to fix them.
After that, crawl your site with a tool like SSL Check . That way, you can catch any leftover links that you forgot. If all is well, it’s time to go live. Well done! Now you just need to update some peripherals.
8. Update your site environment
If that worked fine, now it’s time to take the final steps to complete the transfer to HTTPS:
- Update your sitemap : ideally, your SEO plugin does this automatically. However, it doesn’t always work that way. With Yoast SEO, you may need to disable the plugin once to update the sitemap. Don’t forget to include it in your robots.txt file and update any other hardcoded links you may have there.
- Add the site to webmaster tools : go to each webmaster tool you are using and add the HTTPS version of your site as a new property. While you’re there, upload the new sitemap. You may also consider doing a search and trace, and submit any reject files that are already active for the previous version of your site.
- Update your CDN : if you are using a content delivery network (one of the ways of speed up your site ), you should also change it to SSL. Many of them have that feature built in and your CDN should have documentation on this. Otherwise, ask for their support to help you.
- Change your analytics : if your analytic needs a default URL, be sure to update it with the new prefix. For Google Analytics, you will find the option under Admin > Property Settings > Default URL . Also, note when you made the switch to HTTPS to understand traffic changes.
- Keep social media count : If you display social media counters on your site, you may need to make some changes to keep them up to date. see this guide for more details. Don’t forget to update the links to your site on your social profiles! And do the same in your email templates.
That’s it! You have successfully moved your website to HTTPS. Congratulations, that was no small feat. If all went well, all that’s left is to pat each other on the back and celebrate. In case you run into trouble, here are some troubleshooting tips.
HTTPS Troubleshooting Tips
Unfortunately, moving your site to HTTPS isn’t all sunshine and rainbows. Some things may come up that need to be dealt with.
Mixed Content Warnings
The most common issues that arise after moving your website to HTTPS are mixed content warnings. This happens when the browser finds unsafe links on a secure page. This is usually a matter of updating links to jquery libraries, custom sources, or the like to your HTTPS version.
You usually have to take care of this while scanning your site before you publish it. However, if you encounter a warning like this, be sure to check what is causing it.
Apart from the tools mentioned above, you can also use Why No Padlock? for single pages. So, fix whatever the problem is.
Declining search rankings
Making the switch from HTTP to HTTPS can negatively impact your rankings. What?! Didn’t I say earlier that this is good for SEO? Why would your ranking drop then?
Before you go back and kick HTTPS to the curb, hear me out first. If your SEO is negatively affected, this is usually only temporary.
You see, Google deals with URLs https: // y http: // as two different entities. Even if you set up 301 redirects (as we have done above), they only transfer 90-99% of the link content. This is why your rankings can go down in the beginning.
However, after the initial drop, they should increase over time. As mentioned, Google considers the use of SSL to be a positive ranking factor, so if you move your website to HTTPS, it actually makes it more attractive in their eyes. This will benefit you in the long run.
In one word…
Keeping your site and your traffic safe is one of the most important issues for any website owner. Knowing that you can be trusted with your sensitive data is important to consumers. In times of rising data theft, that’s a great asset and HTTPS and SSL are the tools to achieve it.
In addition to showing confidence to consumers, when you move your website to HTTPS, it also allows you to benefit from increased speed and better SEO. Plus, with a free service like Let’s Encrypt, cost is no longer a deterrent.
Earlier, you learned how to get a free SSL certificate and implement it on your WordPress website. We’ve walked through the steps necessary to move your entire site to HTTP secure premium, and we’ve also discussed other considerations to keep in mind when making the switch.
If you have followed, you can now add HTTPS and SSL to your WordPress website. Know that this is a great investment for the future and where the web is moving. Your visitors, users and your site will thank you.n