You move HTTP to HTTPS by putting a certificate on the hostname people already visit, then sending every HTTP request to that same path over HTTPS with one 301. After the redirect, leftover http images and scripts still break the padlock, so those links change too. A private window on an inner page is the check.
What changes when you move HTTP to HTTPS?
Moving HTTP to HTTPS means the browser loads the same pages over an encrypted connection, and old HTTP addresses permanently point there. The certificate creates the encrypted address. The redirect moves people and search engines. Mixed content is a file on the page that still asks for HTTP.
- The hostname on the certificate must match the address bar.
- One 301 keeps the path, such as a blog post, instead of sending everyone to the homepage.
- Images, CSS, and JavaScript must load over HTTPS or the padlock stays open.
Where do you install the certificate?
On WebJi® hosting the plan already includes a free certificate for the site you host here. In cPanel, open SSL/TLS Status and run AutoSSL for the domain and for www if you use it. Wait until that row says the certificate is installed. A redirect before that point shows a warning, not a padlock.
A paid certificate is a different purchase. Order it from the SSL certificate page when you need organization validation, a wildcard, or a certificate for a server that is not on the free offer. Email support@webji.services with the hostname if AutoSSL does not issue. Do not use the office phone for that.
How do you force HTTPS with one 301?
Use one redirect for the whole site. A homepage-only rule leaves posts and product URLs on HTTP. Keep the path and the query string. Decide once whether the public site is www or the bare domain, and send the other name there in a single hop. Two hops in a row are a chain.
- In cPanel, open Domains, select the domain, and turn on Force HTTPS Redirect when that switch is shown. Save, then request an inner HTTP URL before you edit a file.
- If the switch is missing, add these lines at the top of the document-root .htaccess, above other rewrite rules: RewriteEngine On, then RewriteCond %{HTTPS} off, then RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L].
- On Nginx, the server that listens on port 80 should return 301 to https://$host$request_uri and do nothing else. Test the config and reload only when that test passes.
- If a CDN or a plugin also forces HTTPS, use that switch or the file, not both. Two redirects aimed at each other are a loop.
Open an inner HTTP address in a private window. It should become the same path on HTTPS in one jump, and the page should still be that page. If the browser warns about the certificate, stop and fix the certificate before you hunt for a second redirect.
How do you fix mixed content?
The redirect does not rewrite files inside the page. A style, image, script, or font that still starts with http:// is mixed content, and the padlock stays open or the file is blocked. Convert those HTTP links to HTTPS, or to a root path that has no scheme.
In WordPress, set both addresses under Settings and then General to the HTTPS origin, and replace old links stored in posts. The WordPress site URL guide walks through that save. Search the published source for http://. A widget on another host stays insecure until that host offers HTTPS.
- Search the page source for http://.
- Change src and href on images, CSS, and JavaScript.
- Leave mailto links and in-page anchors alone. They are not mixed content.
What do you update after the redirect?
Add the HTTPS site in Google Search Console, or use a domain property that already covers both schemes. Submit a sitemap whose addresses are HTTPS. Point each canonical at the HTTPS URL you chose, including the www decision. Point analytics at that same origin so you are not measuring two sites.
Do this after the 301 is a single hop. A sitemap of HTTPS addresses that still warn, or that bounce through a second redirect, does not replace the old URLs cleanly.
How do you know the move worked?
Work down this list in a private window. Stop at the first row that fails. The redirect is not done because the homepage loads. An inner page has to pass too.
| Check | What a pass looks like |
|---|---|
| Inner page address bar | https and a closed padlock |
| That page's HTTP URL | one 301 to the same path, no second hop |
| Page source | no http:// on your images, CSS, or scripts |
| www and the bare domain | both land on the one hostname you picked |
A loop means two rules disagree, often the file and a CDN or a plugin. Turn one off and test again in a private window. A padlock that never closes is usually mixed content, or a certificate for a different hostname. The SSL warning guide covers a certificate that is missing, expired, or issued to the wrong name.
Leave a strict-transport header off until the table above is clean. A long lifetime tells the browser to skip HTTP even when your certificate is bad, and that is hard to undo on a visitor's computer.
Frequently Asked Questions
How do I move HTTP to HTTPS?
Install the certificate on the live hostname, add one 301 from HTTP to the same path on HTTPS, then replace http images, styles and scripts. The move is done when a private window shows a closed padlock on an inner page.
Do I need to redirect every HTTP page?
Yes. One rule should cover every path, including posts and product pages. Keep the path and the query string. Send www and the bare domain to the single hostname you chose, in one hop, not through a second redirect.
How do I fix mixed content after HTTPS is on?
Search the page source for http:// and change images, stylesheets, scripts and fonts to HTTPS, or to a path with no scheme. In WordPress, update both site addresses and the links stored in posts. The padlock stays open until those files load over HTTPS.
Will moving to HTTPS change rankings?
A single 301 to the same path keeps the address search engines already know. The risk is a redirect chain, a loop, or a certificate warning that blocks the page. The padlock by itself is not a ranking prize.
Can the certificate be free?
On WebJi® hosting, the plan includes a free certificate for the site you host here. Buy a paid certificate when you need organization validation, a wildcard, or a certificate for a server that is not on that offer. Both kinds encrypt the connection.
How long does the move take in the browser?
The certificate and the 301 can be in place the same day when AutoSSL issues and the rule is valid. Search engines recrawl after you submit the HTTPS sitemap, on their own schedule. The browser check does not wait for that recrawl.