Always redirect visitors to https

Even with a certificate, a visitor can still open your site via http://, without the padlock. So redirect everyone automatically to https. Only do this once the certificate works: first open https://yourdomain.co.uk and https://www.yourdomain.co.uk yourself and check for the padlock.

Force SSL with https redirect

1. Under Account Manager, click Domains and then on your domain name.
2. Check that Secure SSL (1) is switched on. Only then will you see the options below.
3. Under SSL, switch on Force SSL with https redirect (2).
4. Click UPDATE (4).

From now on, anyone who opens http://yourdomain.co.uk will automatically be redirected to https://yourdomain.co.uk.

HSTS

Above that is HSTS, with the switch Enable HTTP strict transport security (3). This tells browsers that your site should from now on only be opened via https. That's slightly safer than just redirecting.

On most of our servers, the web server already sends HSTS by default for every website with https, with a max-age of one year. In that case, you don't need to switch it on. You can check whether your site already sends HSTS in the internet.nl test. More information can be found in HSTS and security headers for your website.

Please note: only switch on this option if your site doesn't send HSTS yet, and only once the certificates work for all names. Browsers remember HSTS for a long time. If the certificate stops working later, visitors may not be able to open your site at all anymore, not even via http. If in doubt, leave the switch off.

Or with .htaccess or your website itself

You can also redirect using a rule in .htaccess, or with a setting or plugin in your website. Only use one method. Two redirects at the same time (for example, Force SSL and a rule in .htaccess that works differently) can sometimes create a loop: the browser will then report that the page isn't redirecting properly.

In WordPress, under Settings, General, set both addresses to https://. This is needed for a padlock without warnings (see No padlock or 'not secure': fixing mixed content).

Frequently asked questions

Force SSL is switched on, but I still end up on the unsecured site

• Your browser might still remember the old page. Try a private window.
• Does public_html contain a .htaccess file with its own rules that redirect first, for example from a caching plugin? These sometimes take priority. In that case, put the https rule at the top of .htaccess, or let the plugin redirect to https.
• Does your site come in via a pointer or subdomain? In that case, switch on https there as well, and make sure that name is included in the certificate.

After switching it on, I get 'too many redirects'

In this case, two settings are redirecting each other back and forth, for example Force SSL and a plugin, or Cloudflare's proxy with the Flexible SSL mode. Switch off one of the two. If you use Cloudflare, choose the Full (strict) SSL mode.