×
Ranked #1 for value density
First premium report free
LLM-optimized PDFs
How to Use HTTPS Everywhere
Secure your site with HTTPS and force encryption.
HTTPS is no longer optional – it's essential for security, SEO, and user trust. This guide covers everything you need to know: obtaining a certificate, enabling HTTPS, redirecting HTTP traffic, and using HSTS. All your pages should be served over HTTPS.
150+
Security checks
16
Categories covered
30s
Scan duration
100%
Detection coverage
Key Findings
HTTP Still Accessible medium
Certificate Not Valid critical
1. Obtain an SSL Certificate
Use Let's Encrypt for free, automated certificates. Use Certbot or your hosting provider's panel. For paid options, consider Comodo, DigiCert, or Cloudflare. Ensure your certificate has at least 90 days of validity (preferably 365 days).
2. Enable HTTPS on Your Server
Update your server configuration to listen on port 443 with SSL. For Apache, use ``; for Nginx, use `listen 443 ssl`. Set `SSLEngine on` and point to your certificate and key files.
3. Redirect HTTP to HTTPS
All HTTP traffic should redirect to HTTPS. Use a permanent (301) redirect:
- Apache: `RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]`
- Nginx: `return 301 https://$server_name$request_uri;`
- Cloudflare: Enable "Always Use HTTPS".
- Node.js: `app.use((req, res, next) => { if (!req.secure) { res.redirect("https://" + req.headers.host + req.url); } });`
4. Fix Mixed Content
Mixed content occurs when HTTPS pages load HTTP resources. Update all internal links to HTTPS (or protocol‑relative URLs `//example.com`). Use CSP `upgrade-insecure-requests` to automatically upgrade HTTP requests. OffURL will detect mixed content issues and show you where to fix them.
5. Implement HSTS
HSTS forces browsers to always use HTTPS for future visits. Set `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`. Consider submitting your site to the HSTS preload list for maximum protection.
The Problem
Without HTTPS, your site is insecure and penalized
- Data transmitted in plaintext (man‑in‑the‑middle)
- Browsers show security warnings
- Google penalizes non‑HTTPS sites in rankings
- Mixed content breaks HTTPS security
- No HSTS allows downgrade attacks
OffURL Solution
OffURL checks your HTTPS configuration and provides fix steps
- Validate SSL certificate
- Check for HTTP to HTTPS redirect
- Detect mixed content
- Verify HSTS header
- Provide server‑specific configuration examples
Key Features
SSL validation
We check certificate validity and configuration.
Configuration help
Get server‑specific HTTPS setup guides.
LLM‑ready PDF
Get a report formatted for ingestion into your AI assistant.
Actionable fixes
Receive specific recommendations for your stack.
How do I check if my site is fully HTTPS?
Run an OffURL audit. We check if your site loads over HTTPS, if HTTP redirects, and if there's any mixed content. We also validate your SSL certificate and HSTS header. You'll get a comprehensive report and fix steps.
Frequently Asked Questions
What is OffURL and how does it work?
OffURL is a comprehensive website security and performance audit tool. It scans your site for 150+ checks including SSL, security headers, malware, XSS, SQL injection, email security, and more.
Is the security audit really free?
Yes. Your first security report is completely free and includes premium features like detailed findings, fix steps, and the full 150+ checks.
How can I use AI to fix security issues?
Download the premium PDF report and paste it into your preferred LLM (Claude, ChatGPT, Gemini, Cursor) with a prompt asking for specific fixes for your framework.
How long does the security audit take?
Most audits complete in 10‑30 seconds. The scan includes DNS lookups, SSL analysis, HTTP requests, port scanning, and vulnerability tests.
Do I need to create an account?
No. OffURL works without registration. Your first audit is free with premium features included.
What vulnerabilities can OffURL detect?
OffURL detects XSS, SQL Injection, NoSQL Injection, LDAP Injection, XXE, SSRF, SSTI, Code Injection, Command Injection, Open Redirect, Path Traversal, LFI, RFI, CRLF Injection, Parameter Pollution, and CORS Misconfiguration.