What is HTTPS and why does your website need it?

Surely you have seen these five letters at the beginning of thousands of addresses:

https://www.cdmon.com

We usually overlook them. We type the domain, the page opens, and we continue browsing. However, when an address starts with HTTPS, it means that the information exchanged between the browser and the server travels protected.

HTTPS encrypts the data exchanged between a website and its visitors. To use it, the server needs a valid digital certificate.

Without this protection, a password, form data, or purchase information could be transmitted without minimum security guarantees.

Years ago, HTTPS was almost exclusively associated with banks and online stores. Today it should be present on any website, from an informational blog to a corporate page with a simple contact form.

What happens when visiting a website with HTTPS

When you access a page, the browser requests different files from the server: texts, images, styles, fonts, or scripts. The server receives the request and returns everything necessary to display the website.

HTTPS protects that exchange before the information leaves each end.

The usual comparison is that of a postcard versus a sealed letter. The content of a postcard is visible throughout the journey. A letter, on the other hand, introduces a layer of protection. HTTPS does something similar with the data traveling between your browser and the page you visit.

To establish that secure communication, the server presents a digital certificate. The browser checks that it belongs to the correct domain, that it has not expired, and that it comes from a recognized authority.

If everything is in order, the browser and the server establish an encrypted connection. The process takes just a few moments and we usually don’t even notice it.

When something doesn’t fit, the browser shows a warning. This can happen, for example, if the certificate has expired or if it was issued for example.com, but the user tries to enter from www.example.com and that second address is not included.

What HTTPS protects and what it does not

HTTPS encrypts the information during the journey to prevent it from being read directly if someone intercepts the communication. In this way, it protects passwords, personal data, and information sent through forms.

It also makes it difficult for someone to intercept or modify the data. This is especially important when browsing from public or unreliable networks.

But HTTPS has a very clear limit: it protects the journey of the information, not the entire website.

Imagine an online store that uses HTTPS but has WordPress and several plugins not updated. The data of its customers will travel encrypted, although the page remains exposed to vulnerabilities.

A website with HTTPS can also contain malware or be part of a phishing campaign. The certificate confirms that you are securely connected to the indicated domain, but it does not guarantee that the person controlling it has good intentions.

Therefore, HTTPS should be accompanied by other measures to protect the website, such as updates, backups, secure passwords, and proper server protection. The certificate is a part of security, not a substitute for everything else.

SSL and TLS: why we use both names

Although we often talk about “SSL certificates,” modern connections use TLS.

SSL was the original protocol. Over time it became obsolete and was replaced by TLS, a more secure technology. The expression “SSL certificate” has remained because it is the name recognized by most users and the one commonly used in the market.

Therefore, when you find a hosting with an SSL certificate, it usually refers to a certificate that allows establishing HTTPS connections using TLS. If you want to expand on this part, check our introduction to SSL certificates.

Current servers should work with TLS 1.2 or TLS 1.3. Previous versions no longer offer adequate protection and many are no longer compatible with modern browsers.

What happens if your website still uses HTTP

When a browser marks a website as “Not secure,” it is not necessarily saying that it is fraudulent. It is warning that the information exchanged with that page does not travel encrypted.

The risk is especially important when the website requests:

• A password.
• Personal data.
• Banking information.
• The submission of a form.
• Access to a private area.

Besides exposing the data, the browser warning may be enough for a person to leave the page before registering, contacting, or purchasing.

In a current website, HTTPS should no longer be considered an extra. It is the minimum configuration expected by both users and browsers.

Does HTTPS help SEO?

Yes, but don’t expect a rise in positions just by installing a certificate.

Google prefers HTTPS versions when it finds equivalent pages and considers security as part of an adequate experience. However, the quality of the content, its relevance, and the response it offers to the search carry much more weight.

The SEO problem arises when a website keeps two versions accessible:

http://example.com

https://example.com

Although to a person they may seem like the same page, technically they are two different URLs. If the configuration is not well resolved, the links, crawling, and positioning signals may be split between both.

The HTTP address should lead to its HTTPS equivalent through a permanent redirect. Canonical tags, internal links, and the sitemap should also use secure addresses.

If you are going to migrate an existing website, you will need to review other elements, such as redirects, mixed content, internal links, the sitemap, and the Google Search Console configuration. It is a process that should be addressed in a specific guide on how to migrate from HTTP to HTTPS.

How to redirect from HTTP to HTTPS

Activating the certificate is not enough for all visits to use the secure connection. The HTTP version must permanently redirect, using a 301 code, to the same address in HTTPS.

For example, http://example.com/contact should lead directly to https://example.com/contact. It is not advisable to send all old pages to the homepage, as the correspondence between URLs would be lost.

The way to do this depends on how the website is built. In WordPress, PrestaShop, Joomla, or Moodle, it can be configured from the CMS itself or with the recommended options for each platform. On a custom-programmed website, it can also be forced from the .htaccess file.

Check how to configure the SSL certificate according to your CMS or follow the complete guide to redirect HTTP to HTTPS. Before modifying .htaccess or installing a plugin, make a backup and avoid activating multiple redirects at once, as they could cause a loop.

What certificate does your project need

A website that uses a single domain usually does not need to pay for a wildcard or multi-domain certificate.

For most blogs, portfolios, and corporate pages, a domain validation certificate is sufficient. This type of certificate verifies that the requester controls the domain.

The choice changes when the project uses several subdomains. A wildcard certificate can cover addresses like:

• blog.example.com
• store.example.com
• clients.example.com

If you need to protect completely different domains, a multi-domain certificate may be more appropriate.

There are also certificates that add checks on the requesting organization. Their usefulness depends on the legal, technical, and commercial needs of the project, not on providing necessarily stronger encryption for a conventional website.

In cdmon you can consult and manage certificates from the Security → SSL Certificates section of the hosting. The panel shows the certificate installed for the main domain and allows reviewing the associated subdomains or aliases. You can also choose between the free Let’s Encrypt certificate and other SSL certificate modalities.

How to check that HTTPS works correctly

That the homepage loads via HTTPS does not prove that the entire website is well configured.

Do a quick check:

• Type the address starting with http://.
• Confirm that it ends at the same address with HTTPS.
• Open several internal pages.
• Review some form or private area.
• Check that images, styles, or fonts are not missing.
• Check the certificate information from the browser.

One of the problems we encounter most frequently after activating HTTPS is not in the certificate. Sometimes it is an old image, a template, or an extension that still tries to load some resource via HTTP.

The homepage may use HTTPS correctly, but that single element can cause a warning or make the page not considered completely secure.

This is known as mixed content: the main page opens via HTTPS, but requests some image, font, stylesheet, or script via HTTP. Browsers may warn of the problem or block active resources, such as scripts and stylesheets.

To locate it, open the browser’s developer tools and review the Console and Network tabs. Look for requests starting with http://. Then, correct the URL in the content, template, plugin, or database that is generating it; it is not enough to hide the warning.

You can also check the installation and validity of the certificate with SSL Shopper and search for insecure resources with Why No Padlock. It is advisable to review several pages, not just the homepage, because mixed content can appear only in a specific entry, form, or section.

You should also check that the certificate includes all the addresses used. If a website works with and without www, both variants must be covered. The same applies to subdomains.

If an error like ERR_SSL_PROTOCOL_ERROR appears, a warning related to the certificate, or a redirect loop, it is not advisable to add rules at random. The origin may be in the server, the CMS, a plugin, a CDN, or in the certificate’s own coverage.

Before considering it finished

HTTPS protects the communication between your website and its visitors. It does not eliminate all threats, but it prevents data from traveling unencrypted and allows checking that the browser connects to the indicated domain.

Before considering the configuration finished, check three things:

• HTTP addresses lead to their HTTPS equivalent.
• The website does not load images or other files via HTTP.
• The certificate covers all domains and subdomains used.

In the cdmon hosting plans you can request, activate, and manage the SSL certificate from the control panel. If something doesn’t fit, from a certificate that doesn’t cover a subdomain to a website that enters a redirect loop, you can consult our guides or contact the 24/7 support team. into an indispensable tool for any website that aims to stand out in the digital environment.