Fix today

Your login page is not secure

What it means

Web pages load in one of two ways. With https:// the connection is encrypted and browsers show a padlock. With plain http:// everything is sent as readable text.

We loaded a page on your site over plain http and found a password box on it. So a visitor, a customer or you yourself could type a password into a page that sends it without any encryption.

It usually means one of three things: the site has no security certificate yet, it has one but still answers on http without redirecting, or an old login page was left behind on the insecure address.

Why it matters

A password sent over http can be read, or quietly changed, by anyone between the visitor and your server. That includes other people on the same coffee shop or hotel Wi-Fi.

Browsers warn about this directly. Chrome marks http pages as "Not secure", and Firefox shows a warning right under the password box. Many people will not type a password after seeing that, and they are right not to.

People reuse passwords, so one captured on your page may unlock their email or bank too. If it is an admin password, it unlocks your whole site.

How to check your own site

1. Open your login page by typing the address with http:// in front, for example http://yoursite.com/login.
2. Look at the address bar once it loads. If it still says http://, or shows "Not secure", the problem is there. If it switches to https:// with a padlock, the redirect is working for that page.
3. Repeat for every page with a password box: the admin login, customer accounts, member areas, and any old or forgotten login pages.

How to fix it

Any website

1. Make sure your site has a valid security certificate. Most hosts provide one free. Look for "SSL", "TLS" or "HTTPS" in your hosting panel, or ask support to turn it on.
2. Check that https://yoursite.com loads with a padlock. If it does not, fix that first, since there is nothing to redirect to yet.
3. Turn on a redirect from http to https for the whole site, not just the login page. Many hosts have a one-click "Force HTTPS" setting.
4. If you or your staff logged in on the insecure page recently, especially on public Wi-Fi, change those passwords once the fix is in place.

WordPress

1. Get https working first, through your host. Then under Settings, General, change both "WordPress Address" and "Site Address" to start with https://.
2. Ask your host to redirect http to https at the server, or use the cPanel or Cloudflare steps below.
3. To make sure the login and admin pages are never served insecurely, your developer can add define( 'FORCE_SSL_ADMIN', true ); to wp-config.php.
4. Check for leftover login forms in widgets or member plugins that might link to an http:// address, and update them.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms issue certificates automatically for domains connected to them, and redirect to https by default. If a password page loads over http, the certificate may still be pending, or the domain may not be fully connected.
2. Check the domain or SSL section of your site settings. Menu names vary, but each platform shows whether the certificate is active. If a newly connected domain still shows a problem after a day or two, contact the platform's support.
3. If the insecure login page is not on the platform at all, such as an old member area on separate hosting, fix it there or remove it.

cPanel hosting

1. Under Security, open "SSL/TLS Status" and run AutoSSL if your host includes it. This issues a free certificate for your domains.
2. Then open Domains and turn on "Force HTTPS Redirect" for your domain. On older cPanel versions this switch may not exist; use the .htaccess rule under "Apache or Nginx" instead.

Cloudflare

1. Under SSL/TLS, Edge Certificates, turn on "Always Use HTTPS". Every http request is then redirected to https.
2. Under SSL/TLS, set the encryption mode to "Full (strict)" if your server has its own valid certificate. The "Flexible" mode leaves the connection between Cloudflare and your server unencrypted, so the password still travels in the clear for part of its trip.

Apache or Nginx

1. Install a certificate first, for example a free one from Let's Encrypt, and confirm https loads.
2. On Apache, add the rewrite rule to the .htaccess file in your site's main folder, or to the site configuration.
3. On Nginx, make the port 80 server block redirect everything to https, test with nginx -t, and reload.

# Apache (.htaccess or site config)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Nginx
server {
  listen 80;
  server_name yoursite.com www.yoursite.com;
  return 301 https://$host$request_uri;
}

What to send your developer

A page containing <input type="password"> is served over http. Serve it over HTTPS, 301-redirect all http requests to https across the whole site, and make sure the login form posts to an https address. Once https is stable everywhere, add Strict-Transport-Security so browsers stop trying http at all. Behind a CDN, use full TLS to the origin, not a mode that downgrades the back leg.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Common questions