← Back to Blog

tutorial

HTTPS Migration: A Complete Step-by-Step Guide for Beginners (2026)

📅 June 18, 2026 • ⏱️ 9 min read | By SSL Checker Tool Team

Migrating a website from HTTP to HTTPS involves more than just installing an SSL certificate. Done incorrectly, you can split your search rankings between two versions of your site, create redirect loops, or end up with a padlock that shows mixed content warnings. This guide covers every step in the right order, including what to verify before you start and how to confirm everything worked after.

🔄

Redirect Checker

Verify your HTTP to HTTPS redirect chain is set up correctly.

Try It Free →

cPanel → Security → SSL/TLS Status

🔒

yourdomain.com — Certificate Active

Issued by: Let's Encrypt · Expires: Jan 14, 2027 · Auto-renews

B VPS / Dedicated Server — Let's Encrypt via Certbot

# Install Certbot on Ubuntu/Debian + Apache
sudo apt update && sudo apt install certbot python3-certbot-apache -y

# Obtain and auto-configure certificate
sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

# Test auto-renewal
sudo certbot renew --dry-run

Certbot will automatically edit your Apache virtual host to enable HTTPS and set up a cron job for renewal. For Nginx, replace --apache with --nginx.

Step 2: Verify the Certificate Is Working

Before redirecting traffic, confirm the certificate is served correctly:

# Test with OpenSSL — should show "Verify return code: 0 (ok)"
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>&1 | tail -5

# Or in your browser: visit https://yourdomain.com directly (no redirect yet)
# Look for the padlock in the address bar

🔒 https://yourdomain.com

🔒

Connection is secure

Certificate valid · Issued by Let's Encrypt · Next renewal: Jan 2027

Click the padlock icon in Chrome to see certificate details

Step 3: Set Up HTTP → HTTPS Redirect

Without a redirect, HTTP and HTTPS will both serve your site — Google sees them as two different sites and splits your link equity.

Apache (.htaccess)

# Add ABOVE the # BEGIN WordPress line (if WordPress)
# or at the top of your root .htaccess file

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Nginx

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

Verify with the Redirect Checker

Use the Redirect Checker to confirm http://yourdomain.com now returns a single 301 redirect to https://yourdomain.com. If you see two or more hops, there's a redirect chain to fix.

🔒 sslchecktool.com/tools/redirect-checker/

301 http://yourdomain.com → https://yourdomain.com

200 https://yourdomain.com — Final destination ✓

Step 4: Fix Mixed Content

Mixed content happens when your HTTPS page loads resources (images, scripts, stylesheets) over HTTP. The browser blocks some mixed content silently and flags others, removing the padlock.

Find Mixed Content

# In Chrome: Open DevTools (F12) → Console tab
# Look for warnings like:
# Mixed Content: The page at 'https://yourdomain.com' was loaded over HTTPS,
# but requested an insecure image 'http://example.com/old-image.jpg'

# Or run a scan with grep on your HTML files:
grep -r "http://" /var/www/html --include="*.html" --include="*.php"

Fix Mixed Content in WordPress

# Using WP-CLI (fastest):
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' \
  --all-tables --precise --report-changed-only

# Or install the "Better Search Replace" plugin:
# WordPress Admin → Tools → Better Search Replace
# Search: http://yourdomain.com
# Replace: https://yourdomain.com
# Select all tables → Run

Step 5: Update Google Search Console and Analytics

1 Add HTTPS property in Search Console

Go to Google Search Console → Add Property → enter https://yourdomain.com. Verify ownership (same methods as before). Submit your updated sitemap (with HTTPS URLs): Settings → Sitemaps → Add sitemap.xml.

2 Update Google Analytics

In GA4: Admin → Property → Property Settings → update the website URL from http:// to https://. Also update any referral exclusion lists, UTM parameters, or tracking code settings that reference the HTTP URL.

Step 6: Post-Migration Verification

✓ Visit https://yourdomain.com — padlock shows without warnings
✓ Visit http://yourdomain.com — 301 redirects to HTTPS
✓ Open Chrome DevTools Console — no mixed content warnings
✓ Run SSL Checker — all green, no chain errors
✓ Run Redirect Checker — single 301 hop, no loops
✓ Check Search Console — HTTPS property receiving data
✓ Update any hardcoded links in email templates, social profiles, or third-party directories

Rankings typically recover within 2–4 weeks. Google re-crawls your 301 redirects and transfers link equity to the HTTPS URLs. You may see a brief fluctuation; this is normal. Monitor Search Console's Coverage and Performance reports daily for the first two weeks.

Common HTTPS Migration Mistakes

Using 302 instead of 301: A 302 (temporary redirect) tells Google not to update its index. Always use 301.
Redirect chains: HTTP → HTTPS is one redirect. HTTP → HTTPS → www → non-www is three. Each extra hop loses PageRank. Consolidate to a single redirect.
Forgetting subdomains: If you have blog.yourdomain.com or shop.yourdomain.com, each needs its own certificate and redirect.
Not updating the sitemap: Your XML sitemap must use HTTPS URLs or Google will see mismatches.

FAQs

Will my search rankings drop after migration?
There may be a brief fluctuation as Google re-indexes the new HTTPS URLs. Long-term, HTTPS is a positive ranking signal. Use 301 redirects and most sites see equal or improved rankings within a month.
Do I need to update all my internal links to HTTPS?
Ideally yes, but it's not critical if your 301 redirect is in place. The redirect handles old internal links automatically. Updating internal links directly avoids the redirect overhead and is better for performance.
My hosting provider already gave me a free SSL — do I still need to set up redirects?
Almost always yes. Many hosts install the certificate but don't automatically redirect HTTP traffic. Test by visiting http://yourdomain.com (without the S) in your browser — if it loads without redirecting, you need to add the redirect rules.

Migrating to HTTPS on Windows Server (IIS)

Windows Server IIS

The HTTPS migration process on Windows IIS follows the same logical steps as Linux — get a certificate, configure the server, set up redirects, fix mixed content — but the tools are different.

Step 1: Get an SSL Certificate for IIS

The fastest path is Let's Encrypt via win-acme, which handles certificate issuance, IIS binding, and renewal automatically. For commercial certificates, generate a CSR using IIS Manager:

:: In IIS Manager:
:: Server → Server Certificates → Create Certificate Request
:: Fill in: Common Name (yourdomain.com), Organization, City, State, Country
:: Choose Microsoft RSA SChannel Cryptographic Provider, Key Length: 2048

:: After your CA issues the certificate, complete the request:
:: Server Certificates → Complete Certificate Request
:: Browse to the .crt file and give it a friendly name

Step 2: Configure HTTPS Binding

# Via PowerShell (after certificate is in the store):
Import-Module WebAdministration

# Add HTTPS binding
New-WebBinding -Name "Default Web Site" -Protocol https -Port 443 -HostHeader "yourdomain.com"

# Assign the certificate
$thumbprint = (Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*yourdomain*"}).Thumbprint
$binding = Get-WebBinding -Name "Default Web Site" -Protocol https
$binding.AddSslCertificate($thumbprint, "My")

Step 3: Redirect HTTP to HTTPS

Add the URL Rewrite rule to your site's web.config (requires the IIS URL Rewrite module):

<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="HTTP to HTTPS" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                  redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

Step 4: Add HSTS Header

# Windows Server 2019 / IIS 10 native HSTS:
Set-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site" `
    -Filter "system.webServer/hsts" -Name "enabled"           -Value $true
Set-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site" `
    -Filter "system.webServer/hsts" -Name "max-age"           -Value 31536000
Set-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site" `
    -Filter "system.webServer/hsts" -Name "includeSubDomains" -Value $true

Verify the migration: After completing all steps, run your domain through our SSL Checker to confirm the certificate chain is complete, the redirect is working, and HSTS is active.

macOS (Homebrew) Migration Note

On macOS with Homebrew Apache or Nginx, follow the Linux steps shown above — the Apache VirtualHost syntax, Nginx server block, and Certbot commands are identical. Config files are at /opt/homebrew/etc/httpd/ (Apache) and /opt/homebrew/etc/nginx/ (Nginx). Reload with brew services restart httpd or brew services restart nginx.

Check your migration is complete

Verify your certificate, redirect chain, and HTTPS configuration with our free tools.

SSL Checker Redirect Checker

← Back to Home Return to Blog

Redirect Checker

B VPS / Dedicated Server — Let's Encrypt via Certbot

Step 2: Verify the Certificate Is Working

Step 3: Set Up HTTP → HTTPS Redirect

Apache (.htaccess)

Nginx

Verify with the Redirect Checker

Step 4: Fix Mixed Content

Find Mixed Content

Fix Mixed Content in WordPress

Step 5: Update Google Search Console and Analytics

1 Add HTTPS property in Search Console

2 Update Google Analytics

Step 6: Post-Migration Verification

Common HTTPS Migration Mistakes

FAQs

Migrating to HTTPS on Windows Server (IIS)

Step 1: Get an SSL Certificate for IIS

Step 2: Configure HTTPS Binding

Step 3: Redirect HTTP to HTTPS

Step 4: Add HSTS Header

macOS (Homebrew) Migration Note

Check your migration is complete

Related Articles