Once your site has a certificate, send everyone who types http:// to https://. It protects every page, and search engines see one address instead of two.
Before you start
Check the site already opens on https:// without a warning. It works on the name the certificate was issued for — yourdomain.com, www.yourdomain.com or a subdomain. Redirecting to any other name shows visitors a certificate error.
Linux hosting (cPanel): .htaccess
Our Linux servers have Apache's mod_rewrite enabled. In your website folder (public_html), create a file called .htaccess — or edit the existing one — and add these lines at the top:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://yourdomain.com%{REQUEST_URI} [R=301,L]Replace yourdomain.com with the exact name on your certificate.
Note
Files starting with a dot are hidden by default. In cPanel's File Manager, open Settings and tick Show Hidden Files.
Windows hosting (Plesk): web.config
Our Windows servers include the IIS URL Rewrite module. In your website folder (httpdocs), create web.config — or carefully edit the existing one — with:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Redirect to HTTPS" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="^OFF$" />
</conditions>
<action type="Redirect" url="https://yourdomain.com/{R:1}" redirectType="Permanent" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>If a web.config already exists, add only the <rule> block inside its existing <rules>.
Tip
WordPress? Set both addresses under Settings → General to https:// as well, or the site keeps linking to itself over HTTP.