Knowledgebase

Once SSL is installed, visitors reaching your site over plain HTTP should be automatically redirected to HTTPS. This guide covers configuring a permanent redirect on both Nginx and Apache.

Why This Matters

• Prevents visitors and search engines from indexing an insecure HTTP version
• Required for many browser security features and modern web APIs
• A positive ranking signal for SEO

Nginx: Forcing HTTPS

If you used Certbot's automatic redirect option, this is already configured. To set it up manually:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    root /var/www/example.com/html;
    index index.html;
}

sudo nginx -t && sudo systemctl reload nginx

Apache: Forcing HTTPS

Enable the rewrite module if not already active:

sudo a2enmod rewrite ssl
sudo systemctl restart apache2

Add to the port 80 VirtualHost block:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</VirtualHost>

sudo apache2ctl configtest && sudo systemctl reload apache2

Verifying the Redirect

curl -I http://example.com

Look for HTTP/1.1 301 Moved Permanently and a Location: https://... header.

Adding HSTS (Recommended Next Step)

HTTP Strict Transport Security tells browsers to never attempt an HTTP connection to your domain again, even if a user types http:// manually:

Nginx (inside the 443 server block):

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Apache:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Only enable HSTS once you're confident HTTPS will remain permanently available — browsers will cache this instruction for the full max-age duration.

Common Errors

Redirect loop (ERR_TOO_MANY_REDIRECTS) — often caused by a reverse proxy or CDN also forcing HTTPS upstream; check X-Forwarded-Proto handling if behind a proxy/load balancer.

Mixed content warnings after redirecting — some page assets (images, scripts) are still hardcoded to http://; update them to protocol-relative or https:// URLs.

Best Practices

• Use a 301 (permanent) redirect, not 302, so search engines update their index correctly
• Test with curl -I after every change
• Add HSTS only after confirming HTTPS works reliably across your whole site

FAQ

Does Certbot set this up automatically?
Yes, if you accept the redirect prompt during certificate installation; this guide is for manual setup or verifying an existing configuration.

Continue Reading

• How to Install Let's Encrypt SSL with Certbot (Nginx & Apache)
• How to Renew and Auto-Renew Let's Encrypt Certificates
• How to Fix Common Nginx Errors (502/504/403)

Browse more articles in SSL/TLS & Certificates.