How to move your site to HTTPS (and fix mixed content)

HTTPS encrypts the connection between your visitors and your site. Browsers label plain-HTTP sites “Not secure”, and Google uses HTTPS as a ranking signal.

Why it matters

Visitors are less likely to trust, buy from or fill in forms on a page marked “Not secure”. If both the HTTP and HTTPS versions load, search engines see two copies of every page.

Mixed content means an HTTPS page loads images, scripts or styles over HTTP. Browsers block insecure scripts outright, which can break your page, and show warnings for the rest.

How to fix it

1. Install a TLS certificate. Most hosts and CDNs, including Cloudflare and Let’s Encrypt, provide one free.
2. Redirect every http:// URL to the same https:// URL with a single 301 redirect.
3. Update internal links, canonical tags and your sitemap to use https://.
4. Fix mixed content by changing http:// resource URLs to https:// (or removing resources that don’t support it).
5. Once everything works over HTTPS, add the Strict-Transport-Security header so browsers always use HTTPS.

Strict-Transport-Security: max-age=31536000; includeSubDomains