# How to enforce HTTPS

> HTTPS encrypts traffic and is a ranking signal. Every http:// request should redirect permanently to https://.

Security · HTML version: https://getreport.app/learn/https

## HTTPS connection

Passing looks like: The site is served over HTTPS.

**Why it matters.** Browsers label HTTP pages "Not secure" and Google uses HTTPS as a small ranking signal. Anyone on the network can read or alter what visitors see.

**How to fix it.**

1. Get a certificate (Let's Encrypt is free) and enable HTTPS on your host.
2. Redirect every http:// URL to https:// with a 301.

## HTTP to HTTPS redirect

Passing looks like: http:// redirects to https://.

**Why it matters.** Visitors who type your address without https, or follow an old link, land on the unencrypted page. Every one of those visits can be read or altered on the network.

**How to fix it.**

1. Redirect every http:// URL to the same path on https:// with a 301.
2. nginx: return 301 https://$host$request_uri; Apache: RewriteRule in .htaccess; most hosts and Cloudflare have a "Always use HTTPS" switch.

Check your own page: https://getreport.app/