HTTP to HTTPS Migration Tips

A checklist-style guide for moving a site from HTTP to HTTPS while avoiding common SEO and mixed-content issues.

Start with the certificate

Install a valid certificate covering every hostname the site actually answers on, including the www variant if it resolves. A certificate that covers the apex but not the subdomain produces a warning that is more alarming to visitors than no encryption at all.

Update the site's own idea of its address

Most content management systems store their base URL. Until that is updated, the site will keep generating absolute HTTP links to itself, and the migration will look half finished no matter what the server is doing.

Hunt down mixed content

A page served over HTTPS that loads a script or stylesheet over HTTP will be blocked or downgraded by the browser. The usual culprits are hard-coded asset URLs in theme files, embedded media, and third-party widgets that never updated.

A whole-site search for the string http:// in templates and in the database catches most of it. The browser console catches the rest.

Redirect once, and permanently

Every HTTP URL should issue a single permanent redirect to its HTTPS equivalent. Redirect chains through www and back, or through a trailing-slash variant, are slower and lose more than a direct hop.

Update everything that points at the site

Sitemaps, robots.txt, canonical tags, analytics properties and search console entries all need updating to the new scheme. Skipping the analytics step is the reason so many migrations look like a traffic collapse when nothing was actually lost.