SupportConsole
llms.txtSign in

Force HTTPS and HSTS

llms.txt

Having a certificate does not mean visitors use it. Someone who types acme-shop.example into the address bar, or follows an old link, still arrives over plain HTTP unless the server sends them on. Force HTTPS is the switch that does that for you: every HTTP request is redirected to HTTPS, and browsers are told to go straight to HTTPS next time.

This article explains where the switch is, what exactly SrvYard changes in Nginx, how HSTS works and why it deserves a little care, how to test it, and how to turn it off again.

Before you begin

  • An active certificate. Force HTTPS needs a certificate that is in use on the site. Follow Get a free Let's Encrypt certificate or Install a custom certificate first.
  • A site that works over HTTPS. Open https://your-domain in a browser and click around before you switch anything on. Mixed content (images or scripts still loaded over http://) is much easier to fix before the redirect.
  • The right permission. Changing SSL settings needs the permission to manage the site's SSL.

1. Turn it on from the SSL tab

Open the site, choose SSL, and look under the certificate card.

The Force HTTPS switch on the SSL tab
Force HTTPS sits under the certificate card; it needs an active certificate.
  1. Force HTTPS. The text reads Redirect every HTTP request to HTTPS. Turn it on once the site works over HTTPS. Flip the switch. SrvYard rewrites the site's Nginx file, tests it and reloads Nginx. The switch settles after a few seconds, and the log of the change is kept with the certificate.
  2. The note below the card. Port 80 stays open: it is used to renew Let's Encrypt certificates. Forcing HTTPS does not close port 80. Port 80 now only redirects, and it keeps answering Let's Encrypt's validation requests, so renewals continue to work. Do not block it in the firewall.

The switch also lives in the site's Settings, in the HTTPS card next to the PHP version.

The HTTPS card on the site Settings tab
The same switch also lives on the site Settings page, under the PHP version.
  1. Force HTTPS. It is the same setting: change it in either place and the other follows. The card says Needs an active SSL certificate.

2. What SrvYard changes

For a site with Force HTTPS on, the generated Nginx configuration changes in two places.

  • Port 80 answers with a redirect. Every request except the Let's Encrypt validation path (/.well-known/acme-challenge/) is answered with a permanent redirect (301) to the same address and path over https://. For example http://acme-shop.example/cart?x=1 becomes https://acme-shop.example/cart?x=1.
  • Port 443 sends the HSTS header. Every HTTPS response carries Strict-Transport-Security: max-age=31536000. That is one year, expressed in seconds, with no includeSubDomains and no preload, so only the exact host name is affected.

HSTS (HTTP Strict Transport Security) tells the browser: for the next year, never talk to this host over plain HTTP, upgrade the request yourself before it leaves the computer. It protects against someone downgrading a visitor's connection on a hostile network and removes the one insecure round trip that a redirect still needs.

Warning

Browsers remember HSTS for the whole period, and the clock restarts each time they see the header. If you later switch Force HTTPS off, the header stops being sent, but visitors who already received it keep being upgraded to HTTPS until their copy runs out. If the certificate then breaks, they see a hard browser error that cannot be clicked past. Keep the certificate healthy before you rely on HSTS.

3. A site without a certificate

Without a certificate there is nothing to force.

The SSL tab of a site without a certificate
Without a certificate there is nothing to force: get or install one first.
  1. Get a free certificate. Start here. The page says that every name of the site must point at the server's IP address and that port 80 must be open. Once the certificate is active, the Force HTTPS switch appears under it. If you try to switch it on through the Settings tab before then, SrvYard answers: Install an SSL certificate first: HTTPS can only be enforced when the site has an active certificate.

4. Test it

After a few seconds, from your own computer:

curl -sI http://acme-shop.example/ | head -n 3
curl -sI https://acme-shop.example/ | grep -i strict

The first command should print HTTP/1.1 301 Moved Permanently and a Location: line that starts with https://. The second should print strict-transport-security: max-age=31536000. In a browser, open the developer tools, switch to the network panel and load the http:// address: the first request should show a 301 and the second one the secure page. Also test a deep link such as /login, not only the home page, because a redirect that loses the path is a classic mistake.

5. Turn it off, deactivate or delete safely

The certificate card has three buttons that matter here.

The buttons of the certificate card
The buttons on the certificate card: deactivating or deleting the certificate in use also affects Force HTTPS.
  1. Renew now renews a Let's Encrypt certificate straight away. It does not change Force HTTPS.
  2. Deactivate stops serving the certificate. There is no confirmation dialog: it starts at once.
  3. Delete removes the certificate and its files from the server.

What each choice means for Force HTTPS:

  • Turn it off with the same switch. Nginx goes back to serving the site on both ports. The browsers' memory of HSTS stays until it expires, as described above.
  • Deactivate the certificate while Force HTTPS is on, and SrvYard switches Force HTTPS off with it. The toast says so: Force HTTPS is switched off with it, so the site keeps working over HTTP. A site must never redirect to a port that cannot answer.
  • Delete the certificate in use is refused while Force HTTPS is on: This certificate is in use and Force HTTPS is on. Turn Force HTTPS off first. Turn the switch off, then delete.
  • Switch to another certificate. Open the menu of the certificate you want in the list and choose Use this certificate.
Tip

If you edit the site's Nginx configuration by hand (Settings > Edit configuration), SrvYard keeps your version. After changing Force HTTPS, open the file again and check that the redirect on port 80 and the HSTS header on port 443 are what you expect, or go back to the Standard configuration template.

Troubleshooting

  • "Install an SSL certificate first". The site has no active certificate. Issue or install one, and wait until it shows In use.
  • The browser says "too many redirects". Something in front of Nginx (a CDN, Cloudflare in Flexible mode, or a load balancer that terminates HTTPS) talks to the server over HTTP, and the server keeps redirecting it. Make the proxy connect over HTTPS, or turn Force HTTPS off and let the proxy do the redirect.
  • A "not private" warning after switching it on. The certificate does not cover the name you are visiting, for example www. was left out. Get a new certificate with all names ticked.
  • The page loads but images are blocked. Mixed content. Change http:// links in your application, or use relative URLs.
  • I turned it off but my browser still goes to HTTPS. That is HSTS. It expires on its own; for a quick test use another browser or a private window.
  • The switch cannot be turned on while another change runs. Wait for the certificate operation to finish (Another certificate is still being set up), then try again.
Last updated 2026-10-247 min readNeed help? Contact support
PreviousGet a free Let's Encrypt certificateNextWildcard certificates with DNS validation