{"id":8893,"date":"2023-12-01T19:05:00","date_gmt":"2023-12-01T13:35:00","guid":{"rendered":"https:\/\/www.wpoven.com\/blog\/?p=8893"},"modified":"2024-05-07T12:29:42","modified_gmt":"2024-05-07T06:59:42","slug":"http-to-https","status":"publish","type":"post","link":"https:\/\/www.wpoven.com\/blog\/http-to-https\/","title":{"rendered":"A Complete Guide on HTTP to HTTPS Migration in WordPress"},"content":{"rendered":"\n

HTTP to HTTPS migration has become one of the essential parameters for any search engine now. It has been made mandatory after Google Chrome announced, “from 24th July 2018, they will consider all the websites working on HTTP as “not secure<\/strong>.”<\/p>\n\n\n\n

In this article, we will provide you with an in-depth guide on HTTP to HTTPS migration in WordPress<\/a>. and give some tips on how to make the whole process easy and smooth. Even some leading Search Engines like Google are trying their best to encourage website owners to move into the more secure web.<\/p>\n\n\n\n

Also, due to new guidelines regulated by leading search Engines and providing SEO benefits, it is the right time to migrate WordPress websites to a more secure side. <\/p>\n\n\n

<\/hr><\/div>\n\n\n\n
<\/hr><\/div>\n\n\n

Let us check out more about Http in the sections down below:<\/p>\n\n\n

<\/hr><\/div>\n\n\n

What do you mean by HTTPS?<\/h2>\n\n\n\n

HTTPS or Hypertext Transfer Protocol Secure is a whole process required to communicate between browsers and websites securely. It is a protocol that is regulated to keep your browser secure from all suspicious attacks. For example, online transactions, saving sensitive information like login credentials, and credit card information, and logging in admin pages.<\/p>\n\n\n\n

Major search engine giant Google is also targeting all their products and services to go 100% encryption. Since security is a top priority at Google, they invest and work to make sure that their sites and services provide modern HTTPS by default. The chart below shows how they’re doing across Google.<\/p>\n\n\n\n

\"Google
Google Migrating its services and products to Https<\/sup><\/em><\/figcaption><\/figure>\n\n\n\n
<\/div>\n\n\n\n

According to the survey conducted by w3techs<\/a>, at present 72.4%<\/strong> of all the websites are on HTTPS.<\/p>\n\n\n

<\/hr><\/div>\n\n\n

What is the need for HTTP to HTTPS migration?<\/h2>\n\n\n\n

If Google is doing it, it is highly essential to migrate your website from HTTP to HTTPS. Below are the major reasons why you need to change:<\/p>\n\n\n\n

1. To provide security<\/h3>\n\n\n\n

As mentioned, earlier HTTPS is a mechanism through which communication between browsers and websites is maintained securely. It means, while migrating from HTTP to HTTPS, you are using your website on an SSL connection. <\/p>\n\n\n\n

It means there is no data leakage or breach that can happen during the interval. This mechanism is highly required where sensitive information is being shared, such as e-commerce transactions and credit card data. <\/p>\n\n\n\n

Although no legal laws have been made, it is a mandatory process. As business owners, it is their responsibility to ensure the safety and security of their customer’s vital information.<\/p>\n\n\n\n

It is not just eCommerce stores but also applicable to other websites, such as your WordPress admin pages, social media accounts, or online banking pages. If you are still on HTTP, the chances are your vital information is being shared on the server as plain text. <\/p>\n\n\n\n

Hence, migrating from HTTP to HTTPS becomes a most important task to ensure the security of your website. Through this, you can restrict access to hackers and other suspicious activities.<\/p>\n\n\n\n

2. Affecting Search Engine Optimization (SEO)<\/h3>\n\n\n\n

Many search engines such as Google have already officially stated that HTTPS is a ranking factor on their SERPs. Although it is not a major ranking factor, most of us would never leave any stone unturned to get a better ranking than our competitors.<\/p>\n\n\n\n

It is worth mentioning that Google has aggressively followed this migration from HTTP to HTTPS for its own products and asking others to follow it. It is likely to be a strong ranking factor<\/a> soon.<\/p>\n\n\n\n

3. Increases Users Trust <\/h3>\n\n\n\n

It has been observed that the majority of users look out for SSL encryption on every website URL they visit. It gives them a sense of security and trust while sharing their vital credentials with the website as more than 75% of users are insecure about their data being compromised online.<\/p>\n\n\n\n

HTTPS not only provides your website security but can also enhance your business brand and standard. Whenever users visit your website, they can freely browse and do the online transaction without any concern.<\/p>\n\n\n\n

4. Enhance Speed<\/h3>\n\n\n\n

HTTPS does not just give an extra protection layer, but it has also been seen after migrating from HTTP to HTTPS. It boosts overall site speed. According to the new protocol implemented HTTPS\/2, the well-optimized sites perform faster and better. It is due to HTTPS can better multiplexing, parallelism, HPACK compression with Huffman encoding, the ALPN extension, and server push.<\/p>\n\n\n\n

5. Referral Data<\/h3>\n\n\n\n

The fifth reason why HTTPS is important is that Google Analytics has blocked HTTP to HTTPS referral data. That means if your website is still using an HTTP connection and suppose your website is being viral and popular on another website such as Reddit, which is an HTTPS website. All the Reddit traffic will be considered direct traffic. Which will be of no use, and referral data will be lost. <\/p>\n\n\n\n

But, if someone is migrating from HTTP to HTTPS, the referral data can still be passed.<\/p>\n\n\n

<\/hr><\/div>\n\n\n

How to Migrate from HTTP to HTTPS?<\/h2>\n\n\n\n

Migrating from HTTP to HTTPS can be very tricky for a user, especially if their website is not running on WordPress. However, to not get tangled in the hassle migration procedures, you must follow the detailed process explained down below.<\/p>\n\n\n\n

1. Choose and Buy SSL certificates <\/h3>\n\n\n\n

To start with the migration process of HTTP to HTTPS, you need SSL certificates for your Website. These certificates are small data files that bind keys with an organization’s crucial information. Most of the time, actually your website has them. It might not be already running.<\/p>\n\n\n\n

But, Some Best hosting providers, such as WPOven<\/a>, also offer free SSL Certificates. To check if your website has them or not, go to https:\/\/yourdomain.com<\/strong> rather than using regular HTTP. And see if there is any red warning. <\/p>\n\n\n\n

The warning sign shows that you either don’t have any certificates installed or it has expired. To know more, click on the information icon as shown below:<\/p>\n\n\n\n

\"HTTP<\/figure>\n\n\n\n
<\/div>\n\n\n\n

After clicking on the information icon, a popup will appear showing whether the certificate is valid or not. If it is valid, then you have an SSL certificate.<\/p>\n\n\n\n

For more details, click on more details to access the complete information about the certificate, i.e. validity date, etc. And if it shows not valid, you probably do not have any SSL certificates installed.<\/p>\n\n\n\n

If you want an SSL certificate for your website, there are plenty of vendors out there. You need to Google them, and a list of online vendors will appear selling SSL certificates online. Just search for the best deal and do not forget to read user reviews before hitting the buy button. <\/p>\n\n\n\n

It is also possible to buy the certificate from the cPanel of your server.<\/p>\n\n\n\n

Types of Certificates<\/strong><\/h4>\n\n\n\n

There are Major three types of SSL certificates available:<\/p>\n\n\n\n

Domain validation:<\/strong> Single or Subdomain, easy email verification, lower price, and can be easily issued within minutes of purchase.<\/p>\n\n\n\n

\"Domain<\/figure>\n\n\n\n
<\/div>\n\n\n\n

Business validation: <\/strong>Best suitable for Business or Organization websites and verifies for a high level of security and trust. Usually, it took up to 3 days for the certificate issued.<\/p>\n\n\n\n

Extended validation: <\/strong>Applicable to domains and sub-domains of business websites for a high level of security and providing a green address bar. It took around up to 7 days (depending on the vendor) for the certificate issue.<\/p>\n\n\n\n

\"Organization<\/figure>\n\n\n\n
<\/div>\n\n\n\n

At WPOven<\/strong>, we provide free Cloudflare SSLs for all sites via our Cloudflare integration. Our Cloudflare SSLs are automatically issued after you configure a domain.<\/p>\n\n\n\n

Using Let’s Encrypt<\/h3>\n\n\n\n

With the help of Let’s Encrypt, you can also get a free SSL certificate. For this, you must check with your hosting service provider and CDN provider whether they are providing Let’s Encrypt Integration or not. <\/p>\n\n\n\n

If you feel things are getting quite messy, you can also opt for Certbot<\/strong>. It is an automatic client that fetches and deploys SSL\/TLS certificates for your webserver.<\/p>\n\n\n\n

\"HTTP<\/figure>\n\n\n\n
<\/div>\n\n\n\n

At WPOven<\/strong>, We provide free SSL certificates using Let’s Encrypt. <\/p>\n\n\n\n

Using our Free SSL Tool, you can install a LetsEncrypt simple SSL certificate on your WordPress site. The tool can be found in your WPOven dashboard, under the \u2018Sites\u2018 section in the \u2018Tools\u2018 subsection.<\/p>\n\n\n\n

A few prerequisites<\/strong> that you need to keep in mind before installing the Free SSL LetsEncrypt certificate are :<\/p>\n\n\n\n

\u2013 Your site is hosted on a WPOven Server
\u2013 The site should have a valid Domain name, whose DNS record should be pointing to your WPOven server IP
\u2013 The site should not be behind any CDN services like Cloudflare.
\u2013 Make sure it is NOT a WordPress MultiSite install. Currently, the Free SSL tool is not applicable for WordPress MultiSite setups.<\/p>\n\n\n\n

To install the Free LetsEncrypt SSL on your WordPress site :<\/p>\n\n\n\n

Step 1<\/u><\/strong>: Log in to your WPOven dashboard and Navigate to the \u2018Sites<\/strong>\u2018 Section. From there, click on the site where you wish to install the LetsEncrypt certificate.<\/p>\n\n\n\n

\"Http<\/figure>\n\n\n\n
<\/div>\n\n\n\n

Step 2<\/strong>: Navigate to the \u2018Tools<\/strong>\u2018 subsection and scroll down to the Free SSL Tool. Click on the \u2018Install Free SSL<\/strong>\u2018 button and that\u2019s it.<\/p>\n\n\n\n

\"Install<\/figure>\n\n\n\n
<\/div>\n\n\n\n

If you face any problems with the SSL installation or have any queries regarding this, please raise a ticket on our support, and we will be happy to help you.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n
<\/hr><\/div>\n\n\n

2. Installing SSL certificates<\/h3>\n\n\n\n

After you purchase an SSL certificate, it’s now time to install them on your WordPress website. While going through the certificate setup with the vendor, you are asked to provide the server type. If you are a WPOven customer, the type of our web servers is Nginx. <\/strong>If that option is not available, then \u201cOther\u201d will work as well.<\/p>\n\n\n\n

To begin with the process, you will require a CSR code by an SSL provider to generate or sign a Certificate. For this, you need to fill up the form by SSL.com.<\/p>\n\n\n\n

\"Online<\/figure>\n\n\n\n
<\/div>\n\n\n
\n\t\t\t\n\t\t\t\t
\n\t\t\t\t\tFill up the form<\/span>\n\t\t\t\t<\/div>\n\t\t\t<\/a>\n\t\t<\/div><\/div>\n\n\n

After filling up, all the required fields, click on the Generate button. The form will generate a key and CSR, which you must save in some folder.<\/p>\n\n\n\n

After completing all the above steps, it is now time to upload the key and CSR file to your SSL provider.<\/p>\n\n\n

<\/hr><\/div>\n\n\n

3. SSL Certificate Verification<\/h3>\n\n\n\n

After purchasing and installing the SSL certificate, now it’s time to ensure the installation process has been successful or not. A quick and effective method is to use the free SSL check tool to carry out the Verification process. If the tool doesn’t detect any issues, it will provide a Grade “A” in the test, which means everything is running fine and great. <\/p>\n\n\n\n

\"SSL<\/figure>\n\n\n\n
<\/div>\n\n\n
<\/hr><\/div>\n\n\n

4. Migrating HTTP to HTTPS<\/h4>\n\n\n\n

After completing the SSL certificate Verification process, it is time to redirect all your Traffic HTTP to HTTPS. There are a lot of migration options available on WordPress. <\/p>\n\n\n\n

301 redirecting to HTTPS<\/h5>\n\n\n\n

One of the most widely used methods is to manually do it in web configuration or using a Free WordPress plugin. It is to be noted that using different types of redirect processes from HTTP to HTTPS can harm your SEO and rankings. Always Follow authentic and genuine sources before implementing them. <\/p>\n\n\n\n

Also, it is to be noted that there is no 100% guarantee of getting all the 301 redirect juice(ranking power). To be practical, about 98% of the total web traffic will be redirected whether you redirect HTTP to HTTPS or the new location.<\/p>\n\n\n\n

If you don’t do 301 redirecting, it might seriously hit your SEO and SERP ranking overnight. Although some Free WordPress plugins are available, which might do the work in a few steps, we do not recommend using them for bulk redirecting URLs.<\/p>\n\n\n\n

 It is much simpler to implement 301 redirects at the server level, especially if you are dealing with hundreds of URLs.<\/p>\n\n\n\n

For Ngnix Server File add the following Command:<\/p>\n\n\n\n

\"301<\/figure>\n\n\n\n
<\/div>\n\n\n\n

And for Apache Server File :<\/p>\n\n\n\n

\"HTTP<\/figure>\n\n\n\n
<\/div>\n\n\n\n

At WPOven<\/strong>, Migrating from HTTP to HTTPS can be carried out by adding Nginx Redirect rules to the Nginx config file.
The server block for HTTP requests should look like this:<\/p>\n\n\n\n

## our http server at port 80
server {
listen 1.2.3.4:80 default;
server_name example.com www.example.com;
## redirect http to https ##
rewrite ^ https:\/\/$server_name$request_uri? permanent;
}<\/strong><\/code><\/p>\n\n\n\n

It would be best if you had another Server block for HTTPS requests, which should look like this:<\/p>\n\n\n\n

## Our https server at port 443. You need to provide ssl config here###
server {
access_log logs\/example.com\/ssl_access.log main;
error_log logs\/example.com\/ssl_error.log;
index index.html;
root \/usr\/local\/nginx\/html;
## start ssl config ##
listen 1.2.3.4:443 ssl;
server_name example.com www.example.com;

## redirect www to nowww
if ($host = 'www.example.com' ) {
rewrite ^\/(.*)$ https:\/\/example.com\/$1 permanent;
}

### ssl config - customize as per your setup ###
ssl_certificate path\/to\/ssl\/certificate.crt;
ssl_certificate_key path\/to\/certificate\/private.key
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers RC4:HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
keepalive_timeout 70;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

## PROXY backend
location \/ {
add_header Front-End-Https on;
add_header Cache-Control \"public, must-revalidate\";
add_header Strict-Transport-Security \"max-age=2592000; includeSubdomains\";
proxy_pass http:\/\/exampleproxy;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
<\/strong><\/code><\/p>\n\n\n\n

After making the changes in Nginx, test the new Nginx config by running the following command :<\/p>\n\n\n\n

nginx -t<\/code><\/p>\n\n\n\n

If this does not show any errors, restart nginx to bring the changes into effect :<\/p>\n\n\n\n

service nginx restart<\/strong><\/code><\/p>\n\n\n

<\/hr><\/div>\n\n\n

Redirecting using a Free WordPress Plugin<\/h3>\n\n\n\n

As mentioned earlier, we do not recommend this for bulk URL redirecting. Since third-party apps add up the burden on the server and introduce new problems and compatibility issues, if your website is small and looking for a temporary solution, you can use a Free WordPress plugin named Really Simple SSL.<\/p>\n\n\n\n

This plugin will automatically detect your settings and configure your website to run over HTTPS. To keep it lightweight, the options are kept to a minimum. The entire site will move to SSL. <\/p>\n\n\n\n

\n