SSL migration - HTTPS encryption for Joomla & WordPress

If your domain does not yet have an SSL certificate, now is the right time. If a website uses forms or collects visitor data in any other way, SSL encryption has been mandatory since the introduction of the GDPR.

In addition to legal requirements, it is also a ranking factor for search engines. Switching to HTTPS is therefore always worthwhile and offers only advantages.

With many providers, an SSL certificate is available free of charge nowadays.

Offer - seamless HTTPS / SSL migration at a fixed price

If you have any concerns about switching to HTTPS, we will gladly handle it for you, including all necessary steps. It does not matter whether you use Joomla or WordPress - we are thoroughly familiar with both systems.

As part of our WordPress / Joomla maintenance plans, adapting your system is included free of charge.

After the SSL certificate has been obtained from your provider and activated, a few website adjustments are still required.
Below you will learn what needs to be considered for Joomla! and WordPress sites regarding the encrypted connection.

In principle, all embedded resources must also be transmitted securely. These include, for example, images, CSS files, JavaScript files or fonts. If this is not the case across the board, the web browser will display a so-called mixed content warning - the padlock in the address bar is not green, but grey and marked with a warning triangle.

Which resources are affected and therefore blocked can be identified via the browser console (right-click -> inspect) or with an SSL checker. A recommended tool for this, which also crawls subpages, is the JitBit SSL Check.

On smaller websites, mixed content errors can be fixed manually - if there is a larger amount of content, a bulk replacement directly in the database is recommended.

Switch Joomla to HTTPS - enable SSL encryption

1. In the system configuration under the Server tab, activate 'Force HTTPS' -> for the 'entire website'. This will redirect every HTTP request to HTTPS. An additional .htaccess redirect is not necessary - Joomla redirects correctly to HTTPS on its own using a 301 code.
2. Fix mixed content warnings - possible necessary steps:

• Adjust image source URLs in articles
• Correct absolute links
• Change the inclusion of CSS/JS/font files in the template to https
  (Some templates and extensions offer an option for this)

WordPress SSL encryption with HTTPS redirect

1. Change the WordPress and site address (URLs) under 'Settings -> General'
2. Correct mixed content errors:

• Update inserted images
  In addition to manual adjustment, the plugin 'Better Search Replace' is ideally suited to replace all occurrences of the unsecured URL with the https version in one go.
• Make sure all CSS/JS/font files are loaded securely by the theme
• Correct menu links

3. Force HTTPS redirect via the .htaccess file
To ensure the site always redirects to the HTTPS version, you can add the following rule to the .htaccess file:

RewriteEngine On

##### Optional redirect non-www to www
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/ [R=301,L]

##### Force HTTPS RewriteCond %{HTTPS} !=on RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

The first section ensures that https://example.org is redirected to https://www.example.org. This is necessary if the SSL certificate is not valid for both variants (which is the case, for example, with Alfahosting or Hosteurope).
If you choose the non-www version (always https://example.org), use this .htaccess rule instead:

##### Redirect www to non-www RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

Switch WordPress to HTTPS using a plugin

Using a WordPress plugin for the HTTPS migration is rather suboptimal. Although the authors of, for example, Really Simple SSL advertise that everything is very easy and only a few clicks are needed - in practice, however, it usually turns out differently and often the purchase of the paid Pro version is necessary to achieve a flawless result. Apart from that, every plugin slows down the website and increases maintenance effort. It is therefore better to avoid using a plugin and make the adjustments manually.

Further recommended steps

• Registering the HTTPS address in Google Search Console
• Updating inbound links, where possible