How to redirect HTTP to HTTPS

Quick answer: Add a permanent (301) redirect in your web server so every http:// request lands on https://. In nginx that is a small catch-all server block; in Apache a Redirect directive or two rewrite lines. Certbot's plugins can add this for you during certificate installation.

Overview

Serving both protocols in parallel splits SEO signals and leaves users on the insecure version. A single 301 redirect consolidates everything on HTTPS and is the expected setup for any modern site.

Before you start

• A valid certificate already installed (how) — redirecting to broken HTTPS locks visitors out.
• SSH access to edit the web-server configuration.

Step-by-step guide

nginx — a dedicated port-80 server block:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

sudo nginx -t && sudo systemctl reload nginx

Apache — in the port-80 virtual host:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent / https://example.com/
</VirtualHost>

sudo apachectl configtest && sudo systemctl reload apache2

Verify the redirect:

curl -I http://example.com   # expect: HTTP/1.1 301 ... Location: https://example.com/

Optionally add HSTS once everything works, so browsers skip HTTP entirely on repeat visits:

add_header Strict-Transport-Security "max-age=31536000" always;

Common issues

• Redirect loop: the app also forces a protocol (or sits behind a proxy) — make exactly one layer responsible for the redirect.
• Only the bare domain redirects: the www host is missing from server_name/ServerAlias.
• HSTS added too early: with mixed content unfixed, HSTS traps users on a broken page — enable it last.

When to contact support

If curl -I shows no answer on port 80 at all, check the firewall first; still stuck, open a ticket with your config snippet and we will take a look.

Frequently asked questions

Should the redirect be 301 or 302?

Use 301 (permanent). It tells browsers and search engines the HTTPS URL is canonical, transfers SEO signals and gets cached, so users go straight to HTTPS on repeat visits.

What causes a redirect loop after enabling HTTPS?

Two layers both forcing a protocol — e.g. the web server redirecting to HTTPS while the app or a proxy redirects back. Make exactly one layer responsible for the redirect.

What is HSTS and should I enable it?

HSTS is a header telling browsers to always use HTTPS for your domain without trying HTTP first. Enable it after confirming HTTPS fully works — it is hard to roll back.

Related articles

• How to install a free SSL certificate
• How to fix the SSL mixed content issue
• How to renew a Let's Encrypt SSL certificate

Ready to get started? Order a VPS at Cloud2Y →