How to secure a website with SSL/TLS and HTTPS

Browsers now treat unencrypted sites as a problem worth warning visitors about, which makes HTTPS table stakes rather than a nice-to-have. Under the hood it uses TLS to encrypt traffic and authenticate your site — “SSL” survives as the name everyone still says, but modern deployments run TLS.

1. List the hostnames to protect

Include every public name visitors use, such as example.com and www.example.com. Decide whether additional subdomains need separate certificates or a wildcard. Confirm each name resolves to the server or can satisfy the certificate authority’s validation method.

2. Choose issuance and renewal

Prefer automated certificate management from the hosting platform or an ACME client. Let’s Encrypt validates domain control using challenges. HTTP-01 is common for public web servers; DNS-01 is useful for wildcard certificates and systems where DNS automation is available.

Keep port 80 reachable when the chosen ACME flow and redirect design require it. Do not expose private keys in source control, tickets, or shared documents.

3. Install the full certificate chain

Configure the web server with the certificate and private key or use the hosting platform’s managed installation. Include the required intermediate chain. Restrict private-key file access to the service account that needs it.

Before changing redirects, connect directly over HTTPS and inspect the result:

curl -I https://example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null

Verify the hostname, issuer, validity period, chain, and current date.

4. Redirect HTTP to the same HTTPS host

Redirect each HTTP URL to the same path on HTTPS first. MDN recommends avoiding an initial redirect from HTTP on one host to HTTPS on another because HSTS cannot be set for the first host in that flow.

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

Then apply any canonical-host redirect on HTTPS. Test for loops and preserve paths and query strings.

5. Remove mixed content

Load the site in a browser and inspect console and network errors. Replace http:// asset, font, script, iframe, API, and form-action URLs with HTTPS. Update application base URLs and generated content rather than relying only on browser upgrades.

6. Automate and test renewal

Confirm the renewal scheduler exists, run the client’s supported dry run, and monitor the certificate actually being served on port 443 — not just the renewal job’s exit code. Expired-certificate outages are rarely caused by the certificate itself; they’re caused by a renewal that had been failing silently for weeks after a DNS, firewall, web-root, credential, or rate-limit change. Alert well before expiry.

7. Add HSTS cautiously

Enable HTTP Strict Transport Security only after HTTPS works on all affected hostnames and recovery is understood. Start with a short max-age, observe, then increase it. Add includeSubDomains only when every subdomain supports HTTPS. Preload is a separate, long-lived commitment.

Sources and further reading

• Let’s Encrypt documentation
• Let’s Encrypt challenge types
• MDN: TLS configuration
• MDN: Strict-Transport-Security