Fix HTTPS redirects and mixed content

Redirect HTTP to HTTPS

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Cloudflare? Use SSL/TLS mode Full (strict). “Flexible” mode talks to your server over HTTP, which together with a server-side redirect causes an endless redirect loop.

Fix mixed content

Mixed content is anything loaded over http:// on an HTTPS page. Find it in DevTools → Console, or in your HackGrade results. In WordPress, update the site URLs under Settings → General, then replace old links in the database (try it with --dry-run first):

wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run

As a safety net, the CSP directive upgrade-insecure-requests makes browsers fetch http:// resources over https://.

Keep the certificate renewing

Certificate lifetimes are getting shorter across the industry, so renewal must be automatic. With certbot:

sudo certbot renew --dry-run