What it is
When you type a website address, it starts with either http:// or https://. That extra "s" stands for "secure" — it means the connection between your visitor's browser and your server is encrypted, so nobody in between (your visitor's Wi-Fi network, their internet provider, anyone snooping) can read or tamper with what's being sent.
A "redirect" is simply an automatic forward: if someone types the old, unencrypted http:// address (or an old bookmark, or a link from years ago), the server should automatically send them to the secure https:// version instead of showing them the insecure page.
Why it matters
Every major browser (Chrome, Safari, Firefox, Edge) actively warns visitors when a site isn't using HTTPS — often with a red or crossed-out padlock and the words "Not Secure" right in the address bar, before they've even read a word of your page. That's an instant trust problem, especially if your site has a login, a contact form, or takes any kind of payment.
Search engines also treat HTTPS as a baseline requirement, not a bonus — a non-secure site can be quietly ranked lower purely for that reason, separate from anything about its actual content.
How to fix it
- Check whether your hosting provider already includes a free SSL/TLS certificate — most modern hosts (Netlify, Vercel, Cloudflare Pages, and most shared hosting control panels) issue one automatically the moment you connect a domain, often via a free service called Let's Encrypt.
- If it's not automatic, look in your hosting control panel for a section called "SSL", "HTTPS", or "Certificates" and enable it there — this usually takes one click and a few minutes to activate.
- Once HTTPS is working (you can visit
https://yourdomain.comand see a padlock), turn on "Force HTTPS" or "Always redirect to HTTPS" if your host offers that toggle. - If there's no toggle, ask your host's support team for the exact one-line configuration they support for redirecting HTTP to HTTPS — every host phrases this slightly differently, and support teams answer this question constantly.
- Test it by typing the plain
http://version of your address into a browser — it should land you on thehttps://version automatically, with no "Not Secure" warning.