Securing Your Website with SSL and Force HTTPS

SSL (Secure Sockets Layer) encrypts data between your website and visitors, ensuring privacy and security. Enforcing HTTPS prevents insecure connections and improves SEO rankings. This guide covers installing SSL certificates, configuring HTTPS redirects, and troubleshooting common SSL issues.

Why SSL and HTTPS Are Critical

• Data Protection: Encrypts sensitive information like login credentials and payment details.
• SEO Benefits: Google prioritizes HTTPS websites in search results.
• Trust: Modern browsers flag non-HTTPS sites as “Not Secure.”

Step 1: Install SSL Certificate

1. Log in to cPanel.
2. Navigate to Security → SSL/TLS.
3. Under Certificates (CRT):
   • Option A: Use AutoSSL (free, automated).
   • Option B: Upload a purchased SSL certificate.
4. Click Install Certificate.

Tip: AutoSSL renews automatically every 90 days.

Step 2: Verify SSL Installation

• Use SSL/TLS Status in cPanel.
• Test with https://www.ssllabs.com/ssltest/ for grade and vulnerabilities.

Step 3: Force HTTPS Using .htaccess

Add the following code to your .htaccess file in public_html:

Explanation:

• RewriteEngine On enables mod_rewrite.
• RewriteCond %{HTTPS} off checks if HTTPS is off.
• RewriteRule redirects all traffic to HTTPS.

Step 4: Update Website URLs

• For WordPress:
  • Go to Settings → General.
  • Update WordPress Address (URL) and Site Address (URL) to https://.
• For other CMS:
  • Update base URL in configuration files.

Step 5: Mixed Content Fix

• Use browser console to identify insecure resources.
• Update image, CSS, and JS URLs to https://.
• For WordPress:
  • Install Really Simple SSL plugin.

Advanced Security Enhancements

• Enable HSTS (HTTP Strict Transport Security): Add to .htaccess:
   

   

   

  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

   
• Disable weak SSL protocols:
  • Configure Apache or Nginx to allow only TLS 1.2 and TLS 1.3.

Troubleshooting

• SSL Not Detected: Check DNS propagation and certificate installation.
• Redirect Loop: Ensure no conflicting rules in .htaccess or CMS settings.
• Browser Warnings: Verify certificate chain and intermediate certificates.