HTTPS explained: why your website needs it and how to switch

HTTPS is the secure version of HTTP, the protocol that carries web pages to your visitors. It encrypts everything sent between the browser and your site, and it proves that the site really belongs to you. You recognise it by the padlock in the browser and an address that starts with https://.

Ten years ago HTTPS was something for banks. Today it is the minimum for any website, even a simple company page.

How it works, in plain words

1. The browser asks the site to identify itself.
2. The site sends its certificate, a digital ID issued by a trusted authority.
3. The browser checks the certificate, and both sides agree on a secret key.
4. From then on all data is encrypted, so nobody on the way (for example on public Wi-Fi) can read or change it.

Why you need it

• Trust: browsers mark sites without HTTPS as "Not secure". Many visitors simply leave, and a contact form on such a page looks risky.
• Safety: passwords, forms and card payments cannot be intercepted.
• Search: Google prefers secure sites and shows them with more confidence.
• Features: many modern browser features, such as installing a site as an app or using the location, work only over HTTPS.
• Law and reputation: if you collect personal data, you are expected to protect it. Encrypting the connection is the basic step.

What is the difference between HTTP and HTTPS?

• HTTP: data travels as plain text. Anyone on the route can read or modify it.
• HTTPS: data is encrypted and the site identity is verified.

Which certificate to choose

• DV (domain validated): confirms that you control the domain. Fast, cheap or free. Right for most small business sites and web shops.
• OV (organisation validated): also checks your company. A good choice if you want to show your identity clearly.
• EV (extended validation): the strictest check. Rarely needed today because browsers no longer highlight it much.
• Wildcard: covers all subdomains, for example shop.example.com and blog.example.com.

Free certificates from Let's Encrypt are trusted by all major browsers and renew automatically. For most sites this is all you need. Many hosting companies install and renew them for you with one click.

How to switch from HTTP to HTTPS

1. Install the certificate on your hosting or server.
2. Redirect every old http:// address to the matching https:// address with a permanent (301) redirect. Use one redirect, not a chain. Decide whether your site uses www or not, and redirect the other version too.
3. Fix "mixed content": make sure images, scripts and styles are also loaded over HTTPS. One old http:// image can break the padlock.
4. Update internal links, canonical tags, the sitemap and your Google Search Console property for the new address.
5. Turn on HSTS when everything works. It tells browsers to always use HTTPS for your site.
6. Test your site with a free checker such as Qualys SSL Labs. Aim for grade A.

Common problems

• "Certificate expired" warning. Use automatic renewal and set a reminder.
• Redirect loops. Usually caused by two systems (for example a CDN and the server) both trying to redirect.
• Padlock with a warning triangle. This is mixed content: find and fix the old http:// links.
• Traffic drop after the move. Check that every old address redirects correctly and the sitemap lists only https addresses.

Done properly, the switch takes an afternoon and your search positions stay as they were.