Forcing HTTPS on your site

By default on managed plans, we redirect HTTP traffic to HTTPS automatically — visitors hitting http://yourdomain.com are bounced to https://yourdomain.com immediately. If for some reason that's not happening, you can enable it explicitly.

Already on by default

If you signed up after we introduced auto-HTTPS-enforcement (2024), your sites are already redirecting HTTP to HTTPS. Test by typing http://yourdomain.com and watching the URL update to https://.

Enable Force HTTPS in cPanel

If you've turned it off, or if your account predates auto-enforcement:

1. Open cPanel from your hosting service.
2. Find SSL/TLS Status under Security.
3. Look for the Force HTTPS Redirect toggle next to your domain.
4. Toggle it on.

The redirect activates immediately — no caching delay.

Via .htaccess

For more control (or if cPanel's toggle isn't available), add this to your .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This redirects every HTTP request to its HTTPS equivalent with a 301 (permanent), preserving the path and query string.

Place it near the top of your .htaccess, before any other rewrite rules.

"Not Secure" warning even after enabling

If browsers still show "Not Secure" after you've enabled HTTPS:

Mixed content

Your page is HTTPS, but it includes resources (images, CSS, JS, iframes) over HTTP. Browsers flag this — even one HTTP image triggers the warning.

Open your browser's developer tools → Console. Look for "mixed content" warnings. Each one tells you which resource needs updating.

To fix:

• HTML/CSS/JS: change src="http://..." and href="http://..." to https:// (or use protocol-relative //... if the resource also serves over HTTP).
• WordPress: install a "Better Search Replace" plugin and replace http://yourdomain.com with https://yourdomain.com in the database.
• Images: re-upload over HTTPS, or update DB references.

Certificate not yet issued

If you just added the domain, give it ~5 minutes for AutoSSL to issue the certificate. If after 30 minutes it still hasn't issued, check that DNS is pointed correctly.

Old browser cache

If you've been testing with HTTP recently, your browser may have cached the HTTP version. Hard-refresh (Ctrl+Shift+R / Cmd+Shift+R) or open in incognito.

CAA records blocking issuance

Your domain's DNS may have CAA records that block Let's Encrypt. Check at Domains → DNS → look for CAA records. If they restrict issuance to specific CAs that don't include Let's Encrypt, edit them to allow Let's Encrypt or remove the CAA records.

HSTS (HTTP Strict Transport Security)

Beyond just redirecting HTTP → HTTPS, HSTS tells browsers "this site is HTTPS-only — never even try HTTP again." Once a browser sees the HSTS header, it caches the directive and will refuse HTTP requests to your domain entirely.

To enable, add to .htaccess:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

This tells browsers to remember HTTPS-only for 1 year (31536000 seconds). The includeSubDomains option extends to all subdomains.

Caution: once HSTS is set, you can't go back. If you ever need to disable HTTPS temporarily (e.g., debugging a certificate issue), browsers that have cached the directive will refuse to load your site over HTTP for the duration of the max-age. Test your HTTPS setup is rock-solid before enabling HSTS.

Power-user note

For maximum HTTPS security, also consider:

• HSTS preload — submit your domain to the HSTS preload list so browsers ship with the HTTPS-only directive baked in. Permanent (you have to wait years to be removed if you ever need to back out).
• Certificate Transparency monitoring — services like crt.sh and Cert Spotter notify you of new certificates issued for your domain (catches CA misissuance attacks).
• TLS configuration — modern TLS 1.2+ ciphers, disable old protocols. We do this server-side; on a VPS you'd configure in nginx/Apache.