HTTPS & SSL Guides

Step-by-step guide to set up a 301 redirect from HTTP to HTTPS on Nginx, Apache, Cloudflare, and WordPress.

Step-by-step guide to fix redirect loops (ERR_TOO_MANY_REDIRECTS): trace the loop, fix conflicting rules in Nginx, Apache, Cloudflare.

Permanent vs temporary redirects, SEO, caching, and when to use 301, 302, 307, or 308—including HTTP→HTTPS. Verify chains with our redirect checker.

Step-by-step guide: install Nginx and Certbot on Ubuntu 24, configure a domain with Let's Encrypt SSL, and set up HTTPS redirect.

Step-by-step guide to fix SSL certificate errors: renewal (Let's Encrypt, certbot), certificate chain, Nginx, Apache, cPanel, Cloudflare.

Missing intermediate certificates cause ERR_CERT_AUTHORITY_INVALID. Fix fullchain.pem, Nginx/Apache config, and verify with openssl or our SSL checker.

Your page is HTTPS but some images, scripts or styles still load over HTTP. Browsers block them or warn. Here's how to find and fix mixed content on your site.

OCSP stapling lets your server attach a fresh revocation proof to the TLS handshake. Faster, more private, one less round-trip to the CA — and three lines of config in Nginx or Apache.

The CA/Browser Forum approved a phased reduction of TLS certificate lifetimes to 47 days by 2029. What changes for renewals, automation, and monitoring.

Let's Encrypt and every modern ACME CA support three validation methods. Wildcards force DNS-01, port-80-closed sites need TLS-ALPN-01, everything else can stick with HTTP-01. A decision guide with certbot examples.

Map each factor in your SSL grade (A+ to F) to a fix: HTTPS, redirect, certificate, modern TLS, HSTS, and security headers — with links to step-by-step guides.

TLS 1.0 and 1.1 are obsolete. Disable them so clients use TLS 1.2 or 1.3 — step-by-step for Nginx, Apache, and Cloudflare.

Guide to HTTP security headers: HSTS, Content-Security-Policy, X-Frame-Options, and more. How to add them in Nginx, Apache, and Cloudflare.

A practical guide to Strict Transport Security preload: header format, subdomain requirements, how to submit at hstspreload.org, and the slow path to remove a domain.

Set-Cookie flags Secure, HttpOnly, and SameSite protect session cookies. How to set them and how our HTTPS checker reports them.

Google treats HTTPS as a ranking signal. See what that means in practice, what to fix, and how to check your site's HTTPS setup for free.

HTTP/2 and HTTP/3 speed up your site with multiplexing and QUIC. Here's what they do and how to turn them on in Nginx and Cloudflare.

HTTP/2 is negotiated in TLS via ALPN. HTTP/3 is advertised via the Alt Svc header. That is why checkers return different answers, and how to confirm support reliably.

CAA DNS records restrict which certificate authorities can issue TLS certs for your domain. Tags, examples, and how our checker surfaces CAA.

DNSSEC signs DNS answers so resolvers can detect tampering. Enable it at your DNS host and registrar, then verify with our checker.

The DNS HTTPS record (type 65, RFC 9460) lets browsers discover ALPN protocols and ECH config before connecting. Cloudflare adds it automatically — here's what it is and what it contains.

Check SSL and HTTPS for up to 10 domains in one go. Get grades, redirect chains, and certificates. Export to PDF or JSON, share report links. No signup.

Continuous HTTPS monitoring: grade changes, redirects, headers, certificate expiry, Certificate Transparency, email and Slack/webhook alerts. Free and paid plans.

A release removes Content-Security-Policy, the site still works, and only a headers monitor or CI policy catches it. How to wire alerts and fail-the-PR checks with httpsornot.

Add a GitHub Actions workflow that fails the PR when security headers fall below a grade — free httpsornot API, no key, headersMinGrade → HTTP 422.

api.securityheaders.com was discontinued in April 2026. Replace it with a free headersMinGrade check — curl, field map, and a copy-paste GitHub Actions workflow.