A website without HTTPS today looks like a shop without a lock on the door. Browsers warn visitors about "insecure" sites and sensitive data, even a simple contact form, travels unencrypted through the network. High time for a clean SSL setup.
Why SSL/TLS is indispensable
SSL (today correctly: TLS) encrypts the connection between browser and server. Inputs, cookies and transmitted content are thus protected from eavesdroppers. Three reasons why HTTPS is mandatory today: data protection under GDPR, the trust of your visitors and an advantage in search. Google has used HTTPS as a ranking signal since 2014, according to Google a slight one, but a plus point all else being equal.
Let's Encrypt: free certificates for everyone
The non-profit certificate authority Let's Encrypt issues trustworthy certificates free of charge. Most hosts integrate this automatically, one click is enough. On your own servers the tool certbot handles setup and ensures automatic renewal every 90 days.
Set up the HTTP-to-HTTPS redirect
So that nobody accidentally opens the unencrypted variant, every HTTP request should be redirected to HTTPS with a 301 redirect. On Apache this is done in the .htaccess, on Nginx in the server block. Important: internal links, images and scripts must also point to HTTPS, otherwise the browser reports "mixed content".
Enable HSTS
With the HTTP header Strict-Transport-Security you tell the browser: "Never come over HTTP again." That reliably protects against downgrade attacks. Start with a short validity and gradually increase it to one year once everything runs stably.
Check the certificate regularly
Even automated renewals can fail, for example after server moves or configuration changes. Tools such as SSL Labs (ssllabs.com) check your configuration free of charge and show weaknesses. A score of "A" or better should be the goal.
Avoid common mistakes
Typical stumbling blocks: outdated TLS versions (disable 1.0 and 1.1), weak cipher suites, missing intermediate certificates or incorrectly configured subdomains. Those who use a host with a managed solution are usually on the safe side here.
Short checklist for checking
- The site can be opened via
https://, the lock appears without a warning. http://redirects tohttps://with exactly one 301 redirect (also with and withoutwww).- No mixed-content message in the browser console: images, scripts and fonts also arrive via HTTPS.
- The certificate does not expire in the next weeks, automatic renewal is set up.
- SSL Labs shows at least an "A" for the domain.
Conclusion
HTTPS today is not a "nice-to-have" but a basic requirement. Setup takes little effort and no licence fees. solutioIT takes over SSL setup, configuration and monitoring as part of web hosting and server support so your lock symbol always lights up. More under web hosting and in our IT maintenance at a fixed price.