Security Critical impact Easy 10–30 min (usually a few clicks at your host)

HTTPS / secure connection

The site must run on HTTPS with a valid certificate.

What it is

HTTPS is an encrypted connection between the visitor's browser and the server. You can recognize it by "https://" and the padlock in the address bar. It is provided by a TLS/SSL certificate.

Why it matters

Since 2014, Google treats HTTPS as a ranking factor, and Chrome marks sites without it as "Not secure", which deters visitors. Without HTTPS, data (forms, passwords) is transmitted in readable form, and modern features (HTTP/2, geolocation, service workers) do not work.

How to do it

1Find out whether your hosting offers a free certificate (Let's Encrypt), and the vast majority do, often with a single click.
2Activate the certificate for both the domain and the www variant.
3Set up a permanent 301 redirect from http:// to https:// (at the server level, not just in the application).
4Fix "mixed content": all internal links, images, and scripts must use https://, not http://.
5Update canonical URLs, the sitemap, and Search Console to the https variant.

http → https redirect in .htaccess (Apache)

Correct

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Conclusion

HTTPS is an absolute basic today, and without it a site loses both trust and rankings and cannot be considered finished. The fix is cheap (free certificate) and fast. After deployment, always verify that no mixed content remains and that the http version 301-redirects to https.