How to force HTTPS

Redirect all HTTP traffic to HTTPS for your application on TurboStack.

On TurboStack you do not need to write a redirect to force HTTPS - it is handled for you. Once a application has an active certificate, the platform serves it over HTTPS and redirects HTTP to HTTPS automatically.

Before you start

Your domain points at the host - see Connecting your domain. Let's Encrypt can only issue a certificate for a name that resolves to the server.
Access to the application's Hostnames settings (or the Source view) to set cert_type.

Make sure HTTPS is active

Give the application a certificate by setting cert_type: letsencrypt (the default for most applications) and publishing - see TLS certificates. Once the certificate is issued, HTTP requests are redirected to HTTPS.

Note

Because the redirect is done at the web-server layer, you do not need an application plugin for it (for example, remove the redundant really-simple-ssl plugin on WordPress). Do not add your own HTTP-to-HTTPS redirect in custom Nginx config - it would duplicate the platform's and can cause redirect loops.

Point your application at HTTPS

So your app generates https:// links and avoids mixed-content warnings, set its site or base URL to the https:// address (for example the WordPress Site Address, or the framework's APP_URL).

Optional: enforce HTTPS in the browser with HSTS

To tell browsers to always use HTTPS for your domain, add the Strict-Transport-Security header - see Add custom HTTP headers:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Warning

Enable HSTS only when HTTPS works on the domain and its subdomains. It is cached by browsers for a long time and is hard to undo.

Verify

An HTTP request should answer with a 301 redirect to the https:// URL:

curl -I http://example.com

If it did not work

No redirect, or a browser warning, means the certificate was not issued yet. Either the domain does not resolve to the host, or the publish has not run. A redirect loop means the application adds a second HTTP-to-HTTPS redirect of its own. Remove that plugin or rule and keep the platform's. See TLS certificate problems, or contact support.