Switch your website to HTTPS

The steps

1. 1Setting up a certificate – For almost all hosts, a click in the administration area; in the background usually runs Let's Encrypt. It renews itself.
2. 2Redirect everything to https – A 301 redirect from http to https, for the whole domain.
3. 3Correct internal references – Images, style sheets and scripts still included with http://.
4. 4Adapting Canonical and Sitemap – Both have to give the https addresses, otherwise you contradict yourself.
5. 5Follow in Search Console – The https version is a property of its own and must be supplemented.

Where it hooks up

Mixed content. If an encrypted page even loads an image over http, browsers block it or warn it. The console of the developer tools names each affected address, often stuck in old posts where image paths have been hardwired.

The forwarding loop behind a proxy. Just check your rule %{HTTPS}, but behind an upstream service this variable is empty, the server redirects endlessly to itself. X-Forwarded-Proto interrogation.