Security and HTTPS Checklist

1 Install and Maintain a Valid SSL Certificate

Use a free certificate from Let's Encrypt or your hosting provider. Ensure it covers your root domain and all subdomains (wildcard or SAN). Set up auto-renewal. Check expiry dates monthly.

# Check SSL certificate details
openssl s_client -connect yourdomain.com:443 \
  -servername yourdomain.com 2>/dev/null \
  | openssl x509 -noout -text | grep -A2 "Validity"

# Install Certbot (Let's Encrypt)
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Test auto-renewal
sudo certbot renew --dry-run

2 Force HTTPS with 301 Redirect

All HTTP traffic must redirect to HTTPS with a permanent 301 redirect. Every request to http:// and https:// non-canonical versions should resolve to your chosen HTTPS canonical URL.

# Nginx: force HTTPS
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://www.yourdomain.com$request_uri;
}

# Apache .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

3 Fix Mixed Content Errors

Mixed content occurs when an HTTPS page loads HTTP resources. Modern browsers block mixed content entirely, breaking page functionality. Use the CSP upgrade-insecure-requests directive to fix this automatically.

# Content-Security-Policy: auto-upgrade HTTP to HTTPS
add_header Content-Security-Policy "upgrade-insecure-requests" always;

# Find mixed content with curl
curl -s https://www.yourdomain.com | grep -i 'src="http://\|href="http://'

4 Implement HSTS (HTTP Strict Transport Security)

HSTS tells browsers to always connect via HTTPS, preventing downgrade attacks and SSL stripping. Set max-age of at least one year and include subdomains.

# Nginx: HSTS configuration
add_header Strict-Transport-Security \
  "max-age=31536000; includeSubDomains; preload" always;

# Apache .htaccess
Header always set Strict-Transport-Security \
  "max-age=31536000; includeSubDomains; preload"

# Verify HSTS header
curl -I https://www.yourdomain.com | grep -i strict

5 Add Content-Security-Policy (CSP)

CSP prevents XSS attacks by controlling which resources can load on your page. Start with a restrictive policy and relax as needed. CSP also fixes mixed content via upgrade-insecure-requests.

# Recommended CSP for most sites
add_header Content-Security-Policy "
  default-src 'self';
  script-src 'self' https://www.googletagmanager.com;
  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
  img-src 'self' https: data:;
  font-src 'self' https://fonts.gstatic.com;
  frame-src 'self' https://www.youtube.com;
  form-action 'self';
  upgrade-insecure-requests;
" always;

6 Add X-Content-Type-Options Header

Prevents MIME type sniffing, which can be used for script injection attacks. The nosniff directive tells the browser to trust the server-declared content type.

add_header X-Content-Type-Options "nosniff" always;

7 Add X-Frame-Options Header

Prevents clickjacking by controlling whether your site can be loaded in an iframe. SAMEORIGIN allows iframes on the same domain only.

add_header X-Frame-Options "SAMEORIGIN" always;

8 Add Referrer-Policy Header

Controls how much referrer information is sent with requests. strict-origin-when-cross-origin is the recommended default for balancing analytics with privacy.

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

9 Add Permissions-Policy Header

Controls which browser APIs your site can access. Disable unused permissions for better privacy and security.

add_header Permissions-Policy \
  "geolocation=(), microphone=(), camera=(), payment=(), usb=()" always;

10 Use Modern TLS Versions

Disable TLS 1.0 and 1.1 (both deprecated). Enable TLS 1.2 and 1.3 only. Modern TLS improves security and connection speed.

# Nginx: modern TLS configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
ssl_ecdh_curve prime256v1:secp384r1;

11 Submit to HSTS Preload List

Submit your domain to the HSTS preload list at hstspreload.org. Browsers include a hardcoded list of HSTS-only sites, ensuring HTTPS is always used even on the first visit.

12 Implement DNS-over-HTTPS (DoH)

DNS-over-HTTPS encrypts DNS queries to prevent eavesdropping and manipulation. While not a direct ranking signal, DoH improves privacy, security, and can speed up DNS resolution. Modern browsers and operating systems support DoH natively. For SEO, DoH ensures that DNS queries related to your site cannot be intercepted or manipulated, preserving the integrity of your traffic and protecting against DNS-based attacks that could harm your search presence.

# What is DNS-over-HTTPS and why it matters for SEO
# DoH encrypts DNS queries using HTTPS, preventing:
# - DNS spoofing/cache poisoning attacks
# - ISP-level DNS hijacking
# - Man-in-the-middle DNS interception
#
# How to test if your DNS uses DoH:
curl -s https://dns.google/resolve?name=yourdomain.com&type=A

# Enable DoH in browsers (user-side):
# Chrome: Settings > Privacy > Use secure DNS
# Firefox: Settings > Network Settings > Enable DNS over HTTPS
# Edge: Settings > Privacy > Use secure DNS
#
# Server-side: Use a DNS provider that supports DoH
# Cloudflare: 1.1.1.1 (supports DoH)
# Google: 8.8.8.8 (supports DoH)
# Quad9: 9.9.9.9 (supports DoH)

13 Monitor GSC Security and Manual Actions

Check Google Search Console weekly for security issues and manual actions. A manual action can remove your site from search results entirely until the issue is fixed and reviewed.