webzod
account

Serve the site over HTTPS on nginx

headers.redirect.no_https · effort: about an hour

Why it matters

Without HTTPS everything visitors send and receive, including passwords and form data, can be read or changed by anyone on the network path. Browsers also label plain http pages as not secure.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Get a certificate (sudo certbot --nginx -d example.com does it and edits the config), or add a port 443 server block like the one below by hand.
  2. Copy the root and location blocks of the port 80 server into it, run sudo nginx -t, then sudo systemctl reload nginx.
  3. Stage 1: test the important pages over https and fix mixed content. Stage 2: when everything works, turn the port 80 server into a redirect to https.
nginx 
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # ... the same root and location blocks as the port 80 server
}

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.