Skip to main content
SlapMyWeb
Slap a site

Security fix

How to Fix a Missing SSL Certificate

Serve the whole site over HTTPS so browsers stop marking it as not secure.

Difficulty
Easy
Impact
High
Time
30-60 min

Before

http://example.com/page   200 OK   (no certificate)

After

http://example.com/page   301 -> https://example.com/page
https://example.com/page  200 OK   (valid certificate)
Before and after code for: How to Fix a Missing SSL Certificate

A missing SSL certificate means the site is served over plain HTTP, so traffic can be read or altered in transit and browsers mark it as not secure. Certificates are free through Let's Encrypt and most hosts issue them in a click. The work is not the certificate; it is redirecting every HTTP URL to its HTTPS equivalent afterwards.

Why it matters

Browsers show a not-secure warning on HTTP pages, which visibly costs trust on any page with a form. HTTPS has also been a ranking signal since 2014, and several browser features refuse to run without it.

How to fix it

  1. Issue the certificate

    Use Let's Encrypt through your host's panel or certbot. Confirm it covers both the apex and the www subdomain if you serve both.

  2. Redirect HTTP to HTTPS

    301 each HTTP URL to the same path on HTTPS. Redirecting everything to the homepage throws away every page's accumulated signals.

  3. Fix mixed content

    Find resources still loaded over HTTP, usually hardcoded absolute URLs in old content, and update them, or browsers will block them.

  4. Update canonicals and the sitemap

    Canonical tags, hreflang and sitemap entries must all point at the HTTPS versions, and the HTTPS property needs adding in Search Console.

The code

Beforetext
http://example.com/page   200 OK   (no certificate)
Aftertext
http://example.com/page   301 -> https://example.com/page
https://example.com/page  200 OK   (valid certificate)

On your platform

WordPress

Update the site and home URLs in settings after switching, then run a search-and-replace over post content for hardcoded http:// links.

Next.js

Termination is usually at the proxy or CDN. Ensure the redirect happens there rather than in application code, so it applies to every response.

Sources

More fixes

Security

How to Add X-Content-Type-Options: nosniff

Stop browsers from MIME-sniffing responses: a one-line header that closes an XSS vector.

Security

How to Add a Permissions-Policy Header

Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.

Security

How to Secure Cookies (Secure, HttpOnly, SameSite)

Add the flags that stop cookies being stolen over HTTP, via XSS, or in CSRF attacks.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs, and links each one straight to its guide.

Run a free audit
Free foreverNo signupLive scan progress