Certificates & Site Ops · Field note
HTTPS Migration Basics for Small Sites
A practical migration guide for moving a small website from HTTP to HTTPS with fewer surprises.
Before you start
Inspect the current certificate, key, token, or endpoint output before changing deployment config; stale artifacts make fixes misleading.
In brief
What it is: A sound HTTPS migration is more than getting a certificate; it also covers redirects, mixed content, cookies, and renewal hygiene.
Why it matters: Small sites avoid repeat outages when they treat HTTPS as a durable operational change instead of a one-time install.
Watch for: Declaring the migration done after the first green lock icon appears.
Moving a small site to HTTPS is one of the highest-value infrastructure upgrades you can make, but it touches more than the certificate itself. Redirects, mixed content, internal links, deployment paths, and renewal all need to line up for the migration to stay clean.
The easiest way to reduce surprises is to treat HTTPS migration as a checklist rather than a single certificate task.
What to plan besides the certificate
- Certificate issuance and renewal are only the start.
- Redirect behavior, canonical URLs, and internal references need consistency after migration.
- Test the live site after deployment, not just the server configuration.
Run through this checklist
- Generate or document the initial certificate command and validation method.
- Update server redirects so HTTP requests move cleanly to HTTPS.
- Review internal links, assets, and templates for protocol-specific references.
- Confirm that the live site serves the correct certificate and content after the change.
Checks people skip
- Treating HTTPS migration as finished the moment the certificate file exists.
- Forgetting to update hard-coded internal asset links.
- Leaving renewal undocumented after a successful first deployment.
Questions that come up in review
Do I need a wildcard certificate to move to HTTPS?
No. Most small sites do not.
Is HTTPS migration only an SEO task?
No. It is also a security, trust, and operational reliability task.
Do this locally (CLI)
Use these commands when you want to confirm the site responds over HTTPS and when the current certificate expires.
curl -I https://example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -enddate
Tip: Paste the curl -I response into the Security Headers Inspector to review the headers that were actually returned. Treat that response as one route and one point in time, not proof of every HTTPS response on the site.
- The redirect, certificate, and content checks belong to the same migration story.
- A certificate can be valid while mixed content or redirect rules still make the migration incomplete.