Nowadays, there’s been an increased concern for the online privacy of users’ sensitive information. It mainly dealt with talks of web hosts selling user information to companies for advertising.
But in that social media chaos, there was also room for “middle-man attacks”. Someone could easily intercept user data before it reaches the website. They can steal usernames, passwords, and bank account information. Files can be replaced with malware, and all because the website connection wasn’t secure.
People are growing more aware of the lack of online safety, and web hosts have picked up on that. Search engines are now pushing for URL transfer from HTTP to HTTPS, because the former is prone to hacker attacks.
No site is safe from these attacks, no matter how small. That is why we’ve made a beginner’s guide to HTTP transfer. At the very end, we’ve also added some tips and tricks.
Why is HTTP bad and HTTPS good?
HTTP stands for “Hyper Text Transfer Protocol,” and HTTPS is the same, except with the added “Secure” at the end. These protocols make the traffic between users and websites easier. Maybe haven’t had experience with these protocols, but you’ve definitely seen them.
They are at the beginning of your URL in your address bar and feature one of two icons on their left. Either a crossed-out padlock or a green one.
Sites that start with HTTP will have a red padlock. It warns that the connection between the user and the website is not secure. The green padlock marks a secure connection.
An unsafe connection
Before you start to worry, an unsafe connection doesn’t mean your website is infected with malware.
It means that all the data you and your visitors’ input, such as usernames, passwords, social security or credit card numbers, is visible to attackers.
Let’s say your site is running through HTTP, and a user wants to download something from you using a public network or Wi-Fi. An attacker monitoring that connection could intercept the download and replace your file with malware.
For this reason, Google Chrome has started pushing all websites to transfer to an https address to protect customer data.
What does this mean for your website?
In the above example, even if you had nothing to do with the attack, the user would hold your website accountable. It could potentially harm their private information and their actual PC.
Every website owner should provide a secure connection for their visitors and customers. Especially if you’re running an online store or offering downloadable materials.
What’s more, Google and other search engines have begun to push HTTP websites further down the search results list. They actively promote https-ran websites over them, increasing their traffic.
What can you do?
That green padlock has become a symbol of trustworthiness and safe browsing in the eyes of users. It is now the first thing they look at when visiting a website.
To make sure that Google (and other webmasters, for that matter) promote your content and products, and gain the trust of future customers, you should take necessary measures.
Your first step is to get an SSL certificate that will bump up your security measures and migrate to an HTTPS version of your website.
WordPress SSL Certificates
SSL stands for Secure Socket Layer and is your main ally in combating man-in-the-middle malware attacks and spyware.
What is SSL exactly?
SSL acts as an encryption tool. It turns data like usernames and passwords into strings of random numbers and letters unreadable to humans. While your website can read the encrypted information perfectly clear. This protects private user information from prying eyes.
It also keeps your downloadable content safe and almost impossible to replace with malware.
How SSL encryption works
How to choose the right WordPress SSL certificate
There are three types of the most commonly used certificates:
a) Extended Validation (EV) –gives you the highest level of security. You get a green padlock, and the address bar turns green. However, this certificate requires you to pass a rigorous filtering process.
b) Domain Validation (DV) – the basic one, acts as a confirmation that you are the website owner
c) Organization Validation (OV) – confirms you as the owner and guarantees that your business is legitimate
Aside from these three types of certificates, there are many more, tailored to specific website owners’ needs. If you want to find out which SSL certificate works best for you, simply go here.
How much do certificates cost?
Luckily for us, many of them are free of charge or on the cheap side. Web hosts usually provide them, so you’ll want to contact your host provider first. They can give you more information on which SLL certificates they support.
That being said, more high-level certificates with better security will cost you more. Extended validation certificates, for example, usually cost a small fortune but provide the best encryption.
It’s good to mention that WordPress admins have taken steps to install SSL certificates automatically on all of their websites, using Let’s Encrypt.
How to get a certificate
Simply obtaining a certificate isn’t enough. To get the “green light” for your website, you’ll need to create a Certificate Signing Request.
This part is a must for identifying which server and domains you plan to use the SSL.
There are four short steps:
- Use Secure Shell to connect to your server
- Run console command
- Input all of your business details, including the URL
- Copy and paste all the information into the request area
NOTE: If your window doesn’t look like the one above, that doesn’t mean something is wrong with your certificate. The window and the process itself vary from one certificate provider to another!
Make sure to look for WordPress tutorials on signing requests that match your SSL. With the certificate obtained and ready to be installed, we can move on to the first step:
SSL Certificate installation: Step 1
Before installing the certificate, back up your website. Mistakes happen, and you don’t want to lose everything.
Alternatively, you can go through these steps on a test server before you try it on your actual website.
1) Automatically
We’ve already mentioned the handy-dandy Let’s Encrypt. WordPress hosts have set it up so that all the websites under their domain get a free certificate. This is what makes WordPress force HTTPS on its websites by default.
2) Using a plugin
We recommend plugins for beginners because they’re easier and mainly take one click.
They take out a lot of the legwork from the manual method, in exchange for less control over the process.
There are many SSL plugins to choose from. For example, Really Simple SSL, Cloudflare Flexible SSL, Force HTTPS, and One Click SSL.
Once you install the plugin, you want to go to Settings and the SSL tab. From there, the plugin will recognize your certificate and apply everything automatically.
3) Manual setup
For the manual setup, follow these steps:
- Go to your WordPress dashboard
- Go to Settings and General
- Update your URL and site address by replacing HTTP with HTTPS, and save changes
- WordPress will then log you out to apply them, and ask you to log back in
After that, you will want to set up the redirect to https:
- Log in to your website through FTP
- Search your main directory for the .htaccess file
- Add the following code:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
By using either of these three methods, you can successfully install an SSL certificate. As soon as you install and activate it, your pages will be encrypted. But there are a few more touch-ups. Without them, you could run into errors.
SSL Certificate installation: Step 2
Test your website!
First of all, you should test your encryption, because odds are that some of your website’s features will either stop working or start showing errors.
Testing is as easy as visiting SSL Labs, inputting the name of your domain, and clicking “submit”.
SSL Labs will give your encryption a score that shows how well the certificate was implemented.
SSL Certificate installation: Step 3
After testing your site, move on to tweaking little things that will go a long way for your website security.
1) Switch to https in the admin area
This ensures that the user’s login information is secure whenever they visit your website.
- Open the WordPress root folder
- Locate and open wp-config.php
- Find the line at the end that tells you to stop editing
- Just above it, type in: define(‘FORCE_SSL_ADMIN’, true);
2) Update links
Change any external links in your theme templates, such as images, embedded audio and video on your website, iframes, as well as internal links.
Simply replace http://with only //, and the links will recreate secure URLs themselves.
3) Update webmaster tools
Submit the https site URLs to Google Search Console.
Why?
Google Webmaster Tools reads HTTP and HTTPS sites as separate properties; it doesn’t redirect users. So your numbers won’t be the same.
Check every webmaster tool you’re currently using, and add your updated https URL as a new property. This will ensure that your secure website version reaches the users.
To be safe, add the non-www versions as well, just in case. In total, this leaves you with four different versions of your site:
- http://www.mysite.com
- https://www.mysite.com
- http://mysite.com
- https://mysite.com
4) Switch the on-page links and analytics
Upgrade the default URL in your Google Analytics. You can locate it by going to Admin>Property Settings>Default URL
Make the same update in your on-page links to any social media accounts, in your email signature, and update your sitemap. After you’ve implemented all the changes, test your site again!
Conslusion
People visiting your website need to know they can trust you with their data. That little green padlock in your address bar is the first step towards it.
Search engines greatly value customer safety. That means this transfer will not only make your business valid, but it’ll mark you as trustworthy and improve your search rankings. So, as soon as you can, make the change and watch your numbers rise.
FAQ
Does switching from HTTP to HTTPS affect SEO rankings immediately?
Migrating from HTTP to HTTPS can positively influence rankings, but results are not always instant. Search engines treat HTTPS as a trust signal, and once redirects are properly configured, authority transfers gradually. Proper 301 redirects ensure you don’t lose traffic during the HTTP to HTTPS migration process.
Will HTTP pages still work after enabling HTTPS?
If 301 redirects are correctly implemented, all HTTP pages will automatically forward users to their HTTPS versions. Without proper redirects, search engines may treat HTTP and HTTPS as separate versions, causing duplicate content and ranking issues.
Can mixed content errors appear after moving to HTTPS?
Yes, mixed content errors occur when HTTPS pages still load HTTP resources like images, scripts, or iframes. Browsers may block these elements, breaking site functionality. Updating all internal links and resources from HTTP to HTTPS prevents security warnings.
Is HTTPS necessary for non-eCommerce websites?
Yes, even informational websites benefit from HTTPS. HTTP connections expose login credentials and user data to interception. HTTPS encryption protects visitors, improves trust signals, and aligns with modern browser and search engine security standards.
Do you need to update Google Search Console after moving from HTTP to HTTPS?
Absolutely. Search engines treat HTTP and HTTPS as separate properties. After migration, you must add and verify the HTTPS version in Google Search Console and resubmit your sitemap to ensure accurate indexing and performance tracking.
