Make every visitor use the secure version of your website, and tell browsers never to use the insecure one.
Once your domain has an SSL certificate, visitors can still type http:// and reach the insecure version of your site. Force HTTPS to send everyone to the secure version automatically.
Forcing HTTPS
- Sign in to HostPanel and go to Domains → SSL/TLS.
- Select your domain.
- In the HTTPS settings, make sure SSL Enabled is ticked, then tick Force HTTPS.
- Click Save.
Every request to http:// is now redirected to https://.
HSTS: the extra step
HSTS tells browsers to always use HTTPS for your domain, even if someone types http:// or follows an old link. It protects visitors on untrusted networks such as public Wi-Fi.
In the same HTTPS settings, choose an HSTS max-age:
- Start short, for example 5 minutes, and check that every page and subdomain still loads over HTTPS.
- Then raise it step by step, finishing at one year or more.
Be careful: browsers remember HSTS for the whole max-age. If you later turn off SSL, or add a subdomain without a certificate, visitors who have been to your site will not be able to open it until the time runs out.
Mixed content warnings
If the padlock is missing or shows a warning after switching to HTTPS, some images, scripts or stylesheets on your pages are still loaded with http://. Change those links to https://. In WordPress, go to Settings → General and make sure both addresses start with https://.