Back to Learning Center
SaaS Security

HTTPS Best Practices Every Developer Should Know in 2026

9 min read
•Updated May 2026

Having an SSL certificate is necessary but not sufficient. A large number of websites have HTTPS enabled but implement it incorrectly — leaving users exposed to downgrade attacks, mixed content vulnerabilities, and misconfigured security headers. This guide covers everything you need to implement HTTPS properly.

1. Redirect All HTTP Traffic to HTTPS

Every HTTP request should be permanently redirected (301) to its HTTPS equivalent. This must be done server-side, not just in your application code.

# nginx — redirect all HTTP to HTTPS
server { listen 80; server_name example.com www.example.com; return 301 https://$host$request_uri; }
# Apache — .htaccess
RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Avoid redirect chains like HTTP → HTTP/www → HTTPS. Each extra redirect adds latency and can cause issues with certain clients. The optimal path is a single 301 from HTTP to HTTPS.

2. Implement HTTP Strict Transport Security (HSTS)

HSTS tells browsers that your site should only ever be accessed over HTTPS. Once a browser receives this header, it will automatically upgrade HTTP requests to HTTPS and refuse to connect if the certificate is invalid — without any user-visible HTTP request.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Start with a short max-age (e.g., 300 seconds) to test, then increase to 31536000 (1 year). Submit your domain to the HSTS preload list so browsers know to use HTTPS even on the very first visit.

3. Fix Mixed Content Issues

Mixed content occurs when an HTTPS page loads resources (images, scripts, stylesheets, fonts, iframes) over HTTP. Modern browsers either block mixed content entirely or display a warning, degrading user experience and triggering browser security warnings.

Find mixed content using:

  • Browser DevTools → Console (look for "Mixed Content" warnings)
  • Chrome DevTools → Security tab
  • Content-Security-Policy with upgrade-insecure-requests directive
# Add to your CSP to auto-upgrade HTTP resources
Content-Security-Policy: upgrade-insecure-requests

4. Essential Security Headers

These HTTP response headers are independent of SSL/TLS but critical to a complete HTTPS implementation:

Strict-Transport-Security
Example: max-age=31536000; includeSubDomains; preload

Forces browsers to only use HTTPS for your domain for the specified duration. Include preload to join the HSTS preload list.

Content-Security-Policy
Example: default-src 'self'; script-src 'self' 'nonce-{random}'

Prevents XSS and data injection attacks by declaring which sources of content are allowed to load on your page.

X-Frame-Options
Example: DENY

Prevents your site from being embedded in iframes on other origins — protects against clickjacking attacks.

X-Content-Type-Options
Example: nosniff

Prevents browsers from MIME-type sniffing the response — ensures content is interpreted as declared.

Referrer-Policy
Example: strict-origin-when-cross-origin

Controls how much referrer information is sent with requests — limits data leakage to third parties.

Permissions-Policy
Example: camera=(), microphone=(), geolocation=()

Restricts which browser features your site can access — formerly called Feature-Policy.

5. Enable OCSP Stapling

When a browser connects to your site, it needs to verify that your certificate has not been revoked. Without OCSP stapling, the browser makes a separate HTTP request to the CA's OCSP responder — adding latency and a privacy concern (the CA learns which sites you visit).

With OCSP stapling, your server periodically fetches a signed OCSP response from the CA and includes it in the TLS handshake. The browser receives the revocation status without making a separate request — faster and more private.

6. Keep Certificates and Configurations Current

Use certificates from trusted CAs with at least 2048-bit RSA keys or P-256 ECDSA
Prefer ECDSA certificates for better performance and equivalent security
Monitor certificate expiry and configuration drift with an external monitoring service
Keep your TLS library (OpenSSL, BoringSSL, etc.) updated — TLS vulnerabilities are patched regularly
Test your HTTPS configuration regularly with SSL Labs or CertNotify

Check Your Security Headers

Use our free Security Headers checker to scan your domain for missing or misconfigured HTTP security headers.

Check Security Headers