Encrypted connection (HTTPS)

What we check

We check two things:

1. Is the home page loaded over HTTPS? If we end up on an address with http://, this is a serious defect.
2. Does the unencrypted address redirect? We open the website with http://. It should redirect directly to the https:// address. If the unencrypted version is reachable without a redirect, there is a warning.

Whether the certificate itself is valid is checked by the article on the security certificate.

Why it matters

HTTPS encrypts the connection between the visitors' browser and the server. Without HTTPS:

• browsers show "Not secure" next to the address. Many visitors leave the page at once, especially when they are asked to fill in a contact form.
• input can be read along, for example on public Wi-Fi: names, phone numbers, messages in the contact form.
• third parties can alter content before it reaches the visitor.
• Google prefers encrypted pages in the search results.

Even with an HTTPS certificate a gap remains if the unencrypted address stays reachable: anyone who types example.ch lands, depending on the browser, on the http:// version first. Only the automatic redirect ensures that all visitors are protected.

How to fix it

1. Activate the certificate

Almost all hosting providers offer free certificates from Let's Encrypt that renew automatically. With most providers you activate it in the administration of the domain with one click. Website builders such as Wix, Jimdo and Squarespace issue the certificate automatically as soon as the domain is connected.

2. Set up the redirect

Many hosting providers have an option "Force HTTPS" or "Redirect to HTTPS". On an Apache server with .htaccess it works like this:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

3. Switch WordPress over

Under "Settings › General" enter the addresses with https:// for "WordPress Address" and "Site Address". The tool "Site Health" under "Tools" shows whether HTTPS is set up correctly.

4. Remove mixed content

If an HTTPS page loads images or scripts over http://, the browser still shows a warning. Replace such addresses with https://.

How to check it yourself

Type http://example.ch into the address bar. After loading, it should say https:// there and a padlock or a settings icon should appear, not a "Not secure" warning.

Frequently asked questions

Does a certificate cost anything?

As a rule, no. Almost all hosting providers issue free certificates from Let's Encrypt and renew them automatically. Paid certificates offer no additional protection for an ordinary company website.

The website has no form. Does it still need HTTPS?

Yes. Browsers warn about every unencrypted page with "Not secure", and without HTTPS third parties can alter content on the way, for example by inserting advertising or malicious code.