You can find a simplified version of this guide in the article Getting Started – HTTPS.
Need help with your website? Find your specialist on VEDOS Profi ⧉.
In this article, you will learn:
- What you need to do to activate HTTPS on your website
- How to force HTTPS connections
- Common Problems
- Frequently Asked Questions
Requirements for running your website over HTTPS
For your website on Webhosting to use a secure HTTPS connection, you must first activate it in the Webhosting Customer Administration in one of these ways:
- by quick setup following the guide Webhosting – Quick HTTPS Setup,
- by manual setup following the guide Webhosting – Manual HTTPS Setup, or
- by deploying your own certificate according to Webhosting – Deploying a Custom SSL Certificate.
Forcing HTTPS
Simply turning on HTTPS on Webhosting does not mean that your website will automatically switch to secure mode. After HTTPS and the certificate have been successfully activated on the Webhosting side, you still need to set up your website so that it uses the secure connection.
In the administration or configuration file of your website, change the settings so that it uses a secure connection. The options may vary, for example:
- changing the website URL in the settings so that it starts with https://
- enabling forced SSL or HTTPS in the settings
- installing a plugin for redirecting to https://
For the ideal approach, consult your webmaster or the support of your content management system.
If the settings above are not available or are not sufficient, add to the .htaccess file (folder www) the rules for redirecting to HTTPS. Copy and paste these rules directly below the existing lineRewriteEngine On:
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R=301,L]
Header set Content-Security-Policy "upgrade-insecure-requests;"
Adding this code may block our application installer. If you run into a problem with the .htaccess file during installation, temporarily restore it, and after a successful installation, copy it back from the automatically created backup.
HTTPS in common content management systems
- WordPress: change both URLs in the WordPress administration, in the Settings General.
- Joomla: change the URL in the file configuration.php in the variable public $live_site. Apply the .htaccess rules above.
- Prestashop: in the website administration, navigate to Shop Parameters General Enable SSL and choose the option Enable SSL on all pages.
- Opencart: in the website administration, navigate to System Settings and choose the specific store. Select the tab Server and check the option Use SSL. Apply the .htaccess rules above.
- Drupal: Apply the .htaccess rules above.
Common Problems
Common problems with HTTPS setup on a website include:
- An error is displayed instead of the website
- Parts of the website do not load
- Google Search Console has stopped working
Website error after forcing HTTPS
Problem: After setting up HTTPS on the website, an error is displayed: 404 Not Found, Not found on Accelerator, or another message about HTTPS not being active.
Cause: HTTPS is not active on the Webhosting itself, or the certificate activation has not yet finished propagating. In rare cases, the certificate may have failed to generate even though the system shows that everything is in order.
Solution: Make sure that you have added the domain to the certificate correctly, and that at least half an hour has passed since the certificate became active according to the administration.
If the certificate has been active in the administration for more than half an hour and the website still does not work, try reloading it without the browser cache using the keyboard shortcut Ctrl+Shift+R. If that does not help either, contact Support via the form ⧉. Include the name of the website and the full text or a screenshot of the error message.
Broken website – mixed content
Problem: After setting up HTTPS on the website, CSS has stopped working, and images and other media are not displayed.
Cause: If the main page uses a secure HTTPS connection, the browser treats all resources loaded over HTTP as potentially unsafe and blocks them.
Solution: If you use your own code, go through it and verify that you specify absolute file addresses with the HTTPS protocol and not HTTP. For example http://domena.tld/obrazek.jpg correct it to https://domena.tld/obrazek.jpg.
If you use a content management system, such as WordPress, look in its documentation or ask its support how to fix the so-called Mixed content.
Google Search Console error
Problem: After forcing HTTPS, I see an error in GSC warning about a redirect.
Cause: If you use the code RewriteRule (.*) https://%{SERVER_NAME}/$1 [R=301,L]in your .htaccess, the insecure version of the page is redirected to the secure one with the return code 301 (moved permanently). Some diagnostic and analytics tools may regard this as a problem.
Solution: Try to disable the problematic code by placing the character # at the beginning of the line. Test thoroughly whether this change has broken the proper functioning of the forced HTTPS.
Frequently Asked Questions
How do I check that HTTPS works correctly?
Enter your website address with http (http://domain.tld) into the browser. If everything is set up correctly, the address will be automatically changed to the https version and marked with a padlock icon. If this does not happen, carefully go through the steps of the guide again, including editing the .htaccess file.