You can find a simplified version of this guide in the article Getting Started – HTTPS.
Need help with your website? Find your specialist at VEDOS Profi ⧉.
In this article you will learn:
- What you must meet to activate HTTPS on the website
- How to force HTTPS
- Common problems
- Frequently asked questions
Conditions for running the website over HTTPS
For your website on Webhosting to use a secure HTTPS connection, you must first activate it in the Webhosting customer administration in one of the following ways:
- quick setup according to the guide Webhosting – Quick HTTPS setup,
- manual setup according to the guide Webhosting – Manual HTTPS setup, or
- deploying your own certificate according to Webhosting – Deploying your own SSL certificate.
Forcing HTTPS
Turning on HTTPS on Webhosting alone does not mean that the website will automatically switch to secure mode. After successfully activating HTTPS and the certificate on the Webhosting side, also configure the website so that it uses the secure connection.
In your website administration or configuration file, adjust the settings so that it uses a secure connection. The options may vary; for example, they include:
- changing the website URL in the settings so that it starts with https://
- forcing SSL or HTTPS in the settings
- deploying a plugin for redirecting to https://
Consult your webmaster or CMS support for the best approach.
If the website setting above is not available or is not sufficient, add rules for redirecting to HTTPS to the .htaccess file (the www folder). Copy and paste these rules directly below the existing line RewriteEngine On:
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R=301,L]
Header set Content-Security-Policy "upgrade-insecure-requests;"
Adding this code may block our application installer. If you encounter a problem with the .htaccess file during installation, temporarily restore it and after a successful installation copy back the automatically created backup.
HTTPS for common content management systems
- WordPress: change both URLs in the WordPress administration, menu Settings General.
- Joomla: change the URL in the configuration.php file in the public $live_site variable. Apply the .htaccess rules above.
- Prestashop: in the website administration, navigate to Shop Settings Main Enable SSL and select Enable SSL on all pages.
- Opencart: in the website administration, navigate to System Settings and choose the specific store. Select the Server tab and check Use SSL. Apply the .htaccess rules above.
- Drupal: Apply the .htaccess rules above.
Common problems
Common problems with setting up HTTPS on a website include:
- An error is displayed instead of the website
- Parts of the website do not load
- Google Search Console stopped working
Website error after forcing HTTPS
Problem: After setting up HTTPS on the website, the error 404 Not Found, Not found on Accelerator, or another message about inactive HTTPS appears.
Cause: HTTPS is not active on the Webhosting itself, or the certificate activation has not yet propagated fully. In rare cases, this may be an error in certificate generation even though the system reports that everything is fine.
Solution: Make sure you have the domain added to the certificate correctly, and that at least half an hour has passed since it became active according to the administration.
If the certificate has been active in the administration for more than half an hour and the website still does not work, try reloading it without the browser cache using the keyboard shortcut Ctrl+Shift+R. If that does not help either, contact support via the form ⧉. Please include the website name and the full text or a screenshot of the error message.
Broken website – mixed content
Problem: After setting up HTTPS on the website, CSS stopped working, images and other media are not displayed.
Cause: If the main page uses a secure HTTPS connection, the browser considers all resources loaded over HTTP potentially dangerous and blocks them.
Solution: If you use custom code, review it and verify that you specify absolute file addresses with the HTTPS protocol, not HTTP. For example, correct http://domena.tld/obrazek.jpg to https://domena.tld/obrazek.jpg.
If you use a content management system, such as WordPress, check its documentation or ask support how to fix so-called Mixed content.
Google Search Console error
Problem: After forcing HTTPS, I see an error in GSC warning about redirection.
Cause: If you use the code RewriteRule (.*) https://%{SERVER_NAME}/$1 [R=301,L] in .htaccess, the page is redirected from the unsecured version to the secure version with return code 301 (permanently moved). Some diagnostic and analytical tools may interpret this as a problem.
Solution: Try disabling the problematic code by placing the # character at the beginning of the line. Thoroughly test whether this adjustment has not broken the proper functioning of HTTPS enforcement.
Frequently asked questions
How do I check that HTTPS is working correctly?
Enter your website address with http into the browser (http://domena.tld). If everything is set up correctly, the address will automatically change to the https version and be marked with a padlock icon. If this does not happen, go through the instructions carefully again, including the .htaccess file adjustment.