Once your domain has an SSL certificate, redirect all visitors from http:// to https://.
Option 1: cPanel (simplest)
- In cPanel, open Domains.
- Find the domain and switch Force HTTPS Redirect to On.
If the switch is greyed out, the domain doesn't have a valid certificate yet; see How to install a free SSL certificate.
Option 2: .htaccess
Add this to the top of the .htaccess file in the site's folder:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
WordPress
Also update the site address to https in WordPress (see How to force HTTPS on your WordPress site), otherwise images and links may still load over http and cause "not secure" warnings.
If you get a "too many redirects" error, see our guide on fixing redirect loops.
