HTTPS

HTTPS is the padlock in the address bar. The plain version, HTTP, sends everything between a visitor’s browser and your server as readable text: page content, form fields, anything typed into a search box. HTTPS wraps that same traffic in encryption so a stranger sitting on the same coffee shop wifi, or the same compromised router, sees scrambled noise instead of your visitor’s name and phone number.

It has been standard for years, but standard and enforced are not the same thing. A site can offer HTTPS and still quietly allow the old, unencrypted version to load if a link or a bookmark points there. Forcing it closes that door. Every request gets bounced to the encrypted version, no exceptions, and the instruction to do that is stamped into every response for a full year, including on subdomains, so a browser remembers and never tries the plain version again even if a stray link somewhere still uses it.

Why it matters to you

Every form on your site, whether it is a quote request, a booking, or a newsletter signup, sends data across the connection HTTPS protects. Without it, that data is exposed the moment it leaves the visitor’s device. With it, the content is unreadable to anyone except your server. Browsers also mark sites without HTTPS as “not secure” directly in the address bar, which is not a subtle warning. It is the kind of thing that makes a first-time visitor close the tab.

How I set it up

This is not something I toggle on later. It is part of how the site is served from day one, alongside the rest of the security headers that ship with every page. The instruction to force HTTPS for a year, including subdomains, means a browser that has visited once will refuse to load an unencrypted version of the site or anything under it, even if someone tries to point it there deliberately. Encryption itself relies on certificates, which renew automatically so there is nothing to remember and nothing that lapses.

Because the site sits behind Cloudflare, the encryption is handled at the edge of Cloudflare’s network before traffic ever reaches the actual files. That means every visitor gets the protection regardless of where they connect from, and there is no server configuration to get wrong.

What it looks like in practice

You will see the padlock icon in the browser bar, and nothing else. Visitors will not notice HTTPS working, because it is meant to be invisible when it works. What they would notice is its absence: a warning banner, a red padlock, or a browser refusing to load the page at all. None of that happens on a site with HTTPS forced properly, and that is the entire goal.