HTTP to HTTPS Migration Checklist: Avoiding Traps & Mixed Content

The short answer: Installing an SSL certificate only enables HTTPS; it does not force it. You must configure a 301 redirect forwarding all port 80 (HTTP) traffic to port 443 (HTTPS), combine your protocol and WWW rewrites into one step, and enable HSTS to prevent downgrade attacks.

Why an SSL Certificate is Not Enough on Its Own

When you install an SSL/TLS certificate (such as Let's Encrypt or Cloudflare Edge SSL), your web server begins answering HTTPS requests on port 443. However, port 80 (insecure HTTP) usually remains open.

If someone types example.com into their browser without specifying https://, the browser defaults to plain HTTP. Without an enforced redirect, your site serves unencrypted content, triggering Google Chrome's "Not Secure" badge and creating duplicate content issues where Google indexes both versions separately.

Should HTTP to HTTPS Redirects Use 301 or 302?

Always use HTTP 301 (Moved Permanently). Never use 302 for HTTPS enforcement.

Google considers HTTPS a confirmed ranking signal. Using a permanent 301 instructs Google's indexer to consolidate all existing backlink equity and historical ranking signals from the old HTTP address directly to the secure HTTPS destination.

Avoiding the HTTP → HTTPS → WWW Chain

A widespread webmaster mistake during SSL migration is implementing two separate rewrite blocks:

1. Rule 1: Redirect HTTP to HTTPS → http://example.com to https://example.com
2. Rule 2: Redirect root to WWW → https://example.com to https://www.example.com

This forces every initial visitor through two roundtrip redirect hops! Combine both transformations into a single rule:

# Apache .htaccess: Single-hop HTTPS + WWW enforcement
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [L,R=301]

What is HSTS (HTTP Strict Transport Security)?

Even with a 301 redirect, the very first request a new visitor makes travels over unencrypted HTTP before receiving the 301 command. A malicious hacker on a public Wi-Fi network could intercept that initial request (a SSL Strip Attack).

HSTS solves this: By sending the header Strict-Transport-Security: max-age=31536000; includeSubDomains, your server instructs the visitor's browser: "Never attempt to contact this domain over plain HTTP again for the next 12 months." On all future visits, the browser automatically converts HTTP to HTTPS internally with zero network latency.