How to Force HTTPS and Redirect HTTP to HTTPS in Plesk

After installing an SSL certificate, you should ensure that all visitors access your website securely via HTTPS. Plesk provides several options to enforce HTTPS, including permanent redirects from HTTP to HTTPS and a security header that tells browsers to always use HTTPS.

Enabling Permanent HTTPS Redirect

1. Log in to Plesk.
2. Go to Websites & Domains → click your domain.
3. Go to Hosting & DNS → Hosting Settings.
4. Find Permanent SEO-safe 301 redirect from HTTP to HTTPS.
5. Check the box to enable it.
6. Click OK.

Now all visitors who type http://yourdomain.com will be automatically redirected to https://yourdomain.com.

Enabling HSTS (HTTP Strict Transport Security)

HSTS tells browsers to always connect to your site via HTTPS, even if the user types http://:

1. Go to Websites & Domains → click your domain.
2. Go to Hosting & DNS → Hosting Settings.
3. Find Enable HSTS.
4. Check the box to enable it.
5. Click OK.

Warning: Once HSTS is enabled, browsers will refuse to connect to your site via HTTP for the duration of the header. If you need to disable SSL temporarily, you may lock visitors out. Use with caution.

Setting HTTPS as Default in Plesk

1. Go to Websites & Domains → click your domain.
2. Go to Hosting & DNS → Hosting Settings.
3. Under SSL/TLS support, select Redirect from HTTP to HTTPS (if available).
4. Click OK.

Important Notes

• The 301 redirect is SEO-safe — search engines will update their index to use HTTPS.
• Ensure your SSL certificate is properly installed and covers all subdomains before enabling permanent redirects.
• After enabling HSTS, submit your site to the HSTS Preload List (hstspreload.org) for maximum security.

Troubleshooting

Redirect loop (infinite redirect):

• This can happen if you have conflicting redirect rules. Check your Apache & nginx Settings for custom redirect directives.
• Clear the redirect setting, save, then re-enable it.

Some pages load without HTTPS:

• Check for mixed content — your pages may be loading resources (images, scripts) over HTTP. Use your browser developer tools to identify mixed content.