What HTTPS does

How it works

HTTPS is HTTP over a TLS connection (Transport Layer Security). Before the first page is sent, browser and server agree on a key. Everything after that is encrypted: forms, passwords, cookies, even the address of the page being visited.

So that the browser knows your website really is at the other end, the server presents a certificate. In it, a certificate authority confirms that the key belongs to your domain name. If the certificate has expired, was issued for another name or comes from an unknown authority, the browser shows a warning instead of the page.

HTTPS is the foundation for every other protective header: without an encrypted connection an attacker could simply strip them out on the way.

What matters

• A valid certificate for every name. With and without www: both names must be in the certificate if both are reachable.
• Automatic renewal. Certificates expire after a few months. If you renew them by hand, one day you will forget.
• Redirect from HTTP to HTTPS. Anyone who types the address without https:// or follows an old link arrives over HTTP. A permanent redirect (status 301) takes them to the encrypted page.
• Same host first. Redirect http://example.com to https://example.com first and only then to https://www.example.com. Only then can the browser learn HSTS for the name that was typed.
• Never back to HTTP. An HTTPS address that redirects to http:// undoes the protection.
• Port 80 may be closed. If the server does not answer over HTTP at all, that is safe, though old http:// links then lead nowhere.

How to set it up

With most hosting providers a free certificate (usually from Let's Encrypt) is one click away in the control panel and renews itself. If you or your agency run the server yourselves, an ACME client such as Certbot issues and renews it.

The redirect belongs in the web server configuration.

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

With Apache the lines also work in .htaccess. Both examples keep the host, as HSTS requires. Switch the site address in your CMS to https:// as well, or it will keep generating links to HTTP.