Website HTTPS Migration Guide: From Certificate to Full Site Migration

HTTPS is standard website infrastructure. Google and Baidu both use HTTPS as a ranking signal.

1. Why HTTPS Matters

  • Data encryption against MITM attacks
  • Authentication of website identity
  • Data integrity
  • SEO advantage
  • User trust (no "Not Secure" warning)
  • Required for HTTP/2, HTTP/3, PWA

2. Migration Steps

Step 1: Get SSL Certificate

Get from Let's Encrypt or purchase from a trusted CA.

Step 2: Configure Web Server

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
}
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

Step 3: Test HTTPS

curl -I https://example.com

Step 4: Fix Mixed Content

grep -r "http://" /var/www/example.com/ --include="*.php" --include="*.html"
Resource Type Fix
Images Use relative paths or HTTPS
CSS/JS Use protocol-relative URLs
API requests Update endpoints
iframes Ensure embedded content supports HTTPS

Step 5: 301 Redirects

Ensure all HTTP requests redirect to HTTPS.

3. SEO Considerations

  1. Add HTTPS site in Google Search Console
  2. Submit new sitemap
  3. Use canonical tags pointing to HTTPS
  4. Update sitemap and robots.txt

4. HSTS Configuration

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Deploy gradually: 1 hour → 1 year → preload list.

5. Common Issues

  • Traffic drop after migration (check redirects, mixed content)
  • Some pages still on HTTP (fix hardcoded links, CMS URL settings)
  • Certificate not auto-renewing (check certbot timer)

6. Checklist

  • SSL installed and working
  • HTTP → HTTPS 301 redirect
  • All internal links use HTTPS
  • DB URLs updated
  • External resources support HTTPS
  • HSTS configured
  • Google Search Console updated
  • Sitemap updated
  • CDN origin using HTTPS
  • API endpoints updated

7. Summary

HTTPS is no longer optional. Follow the proper process, test thoroughly, and monitor post-migration results.