HTTP to HTTPS redirect: one site, one address form

Moving a site to HTTPS is a site move: Google's guide to site moves lists "URL changes from HTTP to HTTPS" among its examples. Every http:// address should answer with a permanent, server-side redirect to its https:// copy, in one hop. Among the kinds of redirect, it is the one that touches every address at once.

One page, four addresses

A single page can be reached at four addresses before anyone adds a path:

• http://example.com/
• http://www.example.com/
• https://example.com/
• https://www.example.com/

Each one can answer with the same content, and to search each is a separate URL until something says otherwise. A trailing slash doubles the count for every other page: /atlas-40 and /atlas-40/ are different addresses too.

The fix is a decision followed by rules. Pick one form, say https://example.com/ with a trailing slash, and make every other form answer with a permanent redirect to it.

Why the redirect is permanent

The move to HTTPS is meant to last, so the redirect should say so. Google's site-move guide, last updated on 2026-08-20 and checked on 2026-10-09, recommends "HTTP permanent redirects if possible, such as 301 and 308," and adds that "301 and other permanent redirects don't cause a loss in PageRank."

A temporary redirect here would keep the http:// addresses in results and withhold the signal that the https:// ones are canonical. The 301 redirect page covers what the permanent code does and how long to keep it: Google advises "generally at least 1 year."

Certificate first, redirect second

The redirect is the last step, not the first. Google's guide says that for a move to HTTPS you should "get and configure the required TLS certificates on your server" before sending anyone there. A redirect to an address that fails its certificate check turns every visit into a browser warning.

Install the certificate, confirm that each https:// address loads without a warning, and only then switch the redirect on. Plan for renewal at the same time: a certificate that lapses later breaks every address the redirect now points to.

One hop, not two

Each old form should go straight to the final address. A common setup handles the protocol and the host in separate rules, so http://www.example.com/ first goes to https://www.example.com/ and only then to https://example.com/. That is a chain of two hops for the most common old address.

Write the rules so that every combination reaches the chosen form directly, and check the awkward case, the old protocol with the old host, explicitly. Redirect chains covers how such chains accumulate and how to collapse them.

Where to set it up

The redirect belongs on the server, or in front of it. Google's site-move guide recommends "server side permanent redirects from the old URLs to the new URLs," and for a change that applies to every address it mentions "a wildcard server-side redirect."

• On Apache: in the server configuration or the site's .htaccess, with the status named, since Apache's redirect directives default to 302. See .htaccess redirects.
• On nginx: usually a separate server block for port 80 that answers every request with a permanent return. See nginx redirects.
• At a CDN or host: many offer an "always use HTTPS" setting. Check which status it sends before relying on it.

Wherever it lives, it should cover every path, not only the home page, and keep the path and query string intact.

Mixed content after the switch

A page served over HTTPS that still loads images, scripts or styles from http:// addresses has only half moved. Browsers treat such resources as mixed content and may block them or mark the page as not fully secure, so the visible result of a correct redirect can be a page with missing images.

Before the switch, search the site's templates and stored content for hard-coded http:// references to your own domain, and change them to https:// or to paths without a protocol. References to other sites need the same check: if a third party does not serve HTTPS, the resource has to be replaced or hosted locally.

Make the other signals agree

A redirect is one signal among several, and the others should point the same way. Internal links should use the https:// form directly rather than relying on the redirect. The sitemap should list only https:// addresses. Each page's canonical tag should name its https:// address in the chosen host form.

Links on other sites will keep using the old addresses for years; the redirect handles those. Your own links are the ones you can correct.

Checking every form

Request each of the four forms of the home page and of a few deeper pages, with and without the trailing slash, and read the response. Every form except the chosen one should answer with 301 or 308 and the chosen address in its Location header, in a single hop. The chosen form should answer with 200.

Repeat the check after any change to the server, the CDN or the certificate, since each of them can reintroduce a second hop. Keep the list of addresses you test, so the same check can be run again in a minute.

FAQ