: Steps to implement Let's Encrypt with cPanel I am implementing to adopt a site from http to https, I am using the Let's Encrypt in cPanel, I am in a shared hosting environment. This is how

@Courtney195

I would not do it as you propose. My suggestion gives you more control over the process resulting as as few errors for your visitors as possible:


Implement LetsEncrypt / https but don't set any redirects yet
Now type in your url and check it yourself. Do/fix as much test as you can/like1.
If you're confident you've got most of it, get a group of users which you tell about the https to do the same (or redirect just this group), usage always reveals more problems.
When you feel you've done all you can, implement the redirect to https 1
Keep checking your reports, possible 404's etc. Again, real usage always reveals errors you haven't found, be prepared for this (if you're lucky it a simply typo).
After a sufficient amount of time, implement HSTS, this way your site isn't accessable via http.


1 I suggest you link to external files like this: //www.example without either http: or https: in the URI
2 No need to remove sessions as they either transfer with you to to the https (unlikely) or they simply expire on the spot. Your users will have to login again if they're switched to https (you might want to give them a heads up).

Vote Up Vote Down

@Pierce454

I run a web hosting business. Hundreds of clients are (or aren't if they are lazy) switching to https via free LetsEncrypt certificates.

To be honest, I think you are overcomplicating things. Install the SSL for the domain, then without changing anything, try using https and see how you go.

You might find a bunch of mixed-content warnings when viewing the developer tools console. This is one of the most important steps as if there is any mixed content i.e. files included using http, you will not see a secure padlock.

There is no need to put a site into maintenance mode. Even if you have the certificate installed, people can still use the legacy http while you are testing.

Then when your are satisfied it is working, add the code to your .htaccess file.

Here's how you test: go to htps://example.com and see if there is a padlock in the address bar. If there is, it is working. If there is still an insecure notification, back to developer tools to look for the problems.

Vote Up Vote Down