Website HTTPS Migration Guide: From Certificate to Full Site Migration

HTTPS is standard website infrastructure. Google and Baidu both use HTTPS as a ranking signal.

1. Why HTTPS Matters

  • Data encryption against MITM attacks
  • Authentication of website identity
  • Data integrity
  • SEO advantage
  • User trust (no "Not Secure" warning)
  • Required for HTTP/2, HTTP/3, PWA

By 2026, more than 90% of page loads worldwide already use HTTPS, and Google's HTTPS reports show nearly all mainstream sites have migrated. Sites still on HTTP get flagged "Not Secure" and can break payment interfaces and API calls: several browsers now block geolocation, camera, and payment requests from HTTP pages by default, and some third-party logins (Apple Sign In, WeChat authorization) require HTTPS callback URLs. This is no longer a "should I" question — the cost of not doing it keeps rising.

2. Migration Steps

Step 1: Get SSL Certificate

Get from Let's Encrypt or purchase from a trusted CA.

Step 2: Configure Web Server

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
}
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

Step 3: Test HTTPS

curl -I https://example.com

Step 4: Fix Mixed Content

grep -r "http://" /var/www/example.com/ --include="*.php" --include="*.html"
Resource Type Fix
Images Use relative paths or HTTPS
CSS/JS Use protocol-relative URLs
API requests Update endpoints
iframes Ensure embedded content supports HTTPS

Step 5: 301 Redirects

Ensure all HTTP requests redirect to HTTPS.

A complete migration walkthrough

Take a small WordPress blog: the whole migration fits in a single working day. In the morning, give DNS time for certificate issuance — request the certificate with Certbot and configure Nginx; before noon, run the basic checks with curl and SSL Labs; in the afternoon, fix mixed content, where the three most common traps are theme-hardcoded image URLs, leftover http:// links in old posts, and absolute addresses emitted by some plugins. Once fixed, flip the site URL from http:// to https://, enable the 301 redirect, and finally submit the new site in Search Console.

The lesson: certificates are rarely the slow part — the real time sink is the "historical debt" in your content. Scan the database for absolute URLs before migrating and you save yourself a lot of rework.

3. SEO Considerations

  1. Add HTTPS site in Google Search Console
  2. Submit new sitemap
  3. Use canonical tags pointing to HTTPS
  4. Update sitemap and robots.txt

4. HSTS Configuration

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Deploy gradually: 1 hour → 1 year → preload list.

There is a trap here: includeSubDomains applies HSTS to every subdomain. If one subdomain (say staging.example.com) still only works over HTTP, browsers will refuse to connect to it entirely once the header is live. Hold off on includeSubDomains and preload until you have confirmed every subdomain supports HTTPS.

5. Common Issues

  • Traffic drop after migration (check redirects, mixed content)
  • Some pages still on HTTP (fix hardcoded links, CMS URL settings)
  • Certificate not auto-renewing (check certbot timer)

6. Checklist

  • SSL installed and working
  • HTTP → HTTPS 301 redirect
  • All internal links use HTTPS
  • DB URLs updated
  • External resources support HTTPS
  • HSTS configured
  • Google Search Console updated
  • Sitemap updated
  • CDN origin using HTTPS
  • API endpoints updated

7. Summary

HTTPS is no longer optional. Follow the proper process, test thoroughly, and monitor post-migration results.

Reference: Let's Encrypt docs https://letsencrypt.org/docs/
Reference: Mozilla SSL Configuration Generator https://ssl-config.mozilla.org/
Reference: SSL Labs https://www.ssllabs.com/ssltest/