How to Move HTTP to HTTPS

Moving HTTP to HTTPS means three separate jobs: a certificate is installed on the hostname people already visit, every old HTTP address is sent to the same path over HTTPS with one permanent 301, and every file inside the page that still asks for http:// is replaced. Each job has its own failure mode, which is why "I installed SSL but the padlock is open" is the most common support line on this topic.

• The certificate creates the encrypted address — its hostname must match what is in the address bar.
• The 301 redirect moves visitors and search engines, keeping the path so a blog post lands on the same blog post.
• Mixed content is any image, style or script still loaded over HTTP; the padlock stays open until it is fixed.

The reasoning behind the encryption itself — what changes for rankings and trust — is covered in HTTP vs HTTPS; this page is the working migration.

Use one redirect for the whole site — never a homepage-only rule — keep the path and query string, and decide once whether the public site is www or the bare domain so the other name joins the same destination in a single hop. Two hops in a row form a chain; two rules aimed at each other form a loop.

1. Try the panel switch first: in cPanel, open Domains, select the domain, and turn on Force HTTPS Redirect where it is shown. Save, then request an inner HTTP URL before touching any file.
2. If the switch is missing, put these lines at the top of the document-root .htaccess, above other rewrite rules:

   RewriteEngine On
   RewriteCond %{HTTPS} off
   RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

3. On Nginx, the server block listening on port 80 should do nothing but return 301 https://$host$request_uri; — test the config and reload only when the test passes.
4. One enforcer only. If a CDN or a plugin also forces HTTPS, use its switch or the file, never both.

Then open an inner HTTP address in a private window: it should become the same path on HTTPS in one jump, and the page should still be that page. A certificate warning at this stage means the certificate work above is not finished — stop and fix it before hunting for a second redirect. The syntax-level detail of rewrite rules has its own page in the .htaccess 301 redirect guide, and domain-to-domain moves in redirecting one domain to another.

Add the HTTPS property in Google Search Console — or use a domain property that already covers both schemes — submit a sitemap whose addresses are HTTPS, point every canonical at the HTTPS URL you chose including the www decision, and point analytics at that same origin. Do this only after the redirect is a single hop; a sitemap of HTTPS addresses that bounce through a second redirect replaces nothing cleanly.

Skipping the Search Console step does not break the site, but it leaves you measuring the migration half-blind: you will not see which old HTTP URLs still earn impressions instead of their HTTPS replacements. The SSL certificate checker is the quick way to re-verify the certificate weeks later.

Work down this list in a private window and stop at the first failing row — the move is not done because the homepage loads; an inner page has to pass too.

A loop means two rules disagree — most often the file and a CDN or a plugin; turn one off and retest. A padlock that never closes is mixed content or a certificate issued to a different hostname, and the SSL troubleshooting guide takes that case in full.