How to force HTTPS on your HostGator site
Forcing HTTPS ensures that visitors use an encrypted connection whenever they open your HostGator website. Rather than leaving an insecure http:// address available, the server sends those requests to the corresponding https:// page. The certificate and the redirect work together: encryption protects the connection, while the redirect makes it automatic.
Australian small businesses often manage their websites while travelling between offices, homes and client sites in Melbourne, Brisbane, Sydney or regional towns. Mobile data and public Wi-Fi connections make encrypted browsing especially important, and a visible secure connection can reassure customers. A .com.au domain also signals a local presence, but it does not make the site secure by itself.
HostGator customers can manage domains, invoices, webmail, tutorials and support through the hosting account area. A broader web hosting guidance resource can help new website owners understand how these tools fit together before changing the site’s URL settings.
Understand what HTTPS redirects change
An SSL/TLS certificate creates the encrypted connection between a visitor’s browser and your server. Once the certificate is active, a correct HTTPS redirect sends any plain HTTP request to the secure version of the same page. This prevents visitors from accidentally remaining on an unprotected address after your site has been configured for encryption.
A permanent server redirect normally returns an HTTP 301 status, which tells browsers and search engines that the secure address is the new permanent location. You should also choose one canonical hostname, either www.example.com.au or example.com.au, and avoid redirecting the two versions back and forth. Redirect loops can make a website appear unavailable even though the certificate is working.
For organisations covered by Australia’s Privacy Act 1988, encryption can support the security obligations in the Australian Privacy Principles. It does not make a business compliant on its own: access controls, secure payment processing, accurate privacy information and response plans still matter. The Australian Cyber Security Centre recommends treating websites and customer data as part of a broader security program.
Set up the secure connection in cPanel
Sign in to the HostGator customer area and open cPanel for the relevant hosting account. Look for Domains, SSL/TLS Status or a similarly named security section. Interface labels vary between cPanel versions and HostGator plans, but the sequence is generally to install or activate a certificate first and configure the HTTPS redirect afterwards.
Open the SSL/TLS status page and select Run AutoSSL or the applicable certificate option. Choose the domain that needs protection, confirm the included names, and start the validation process. AutoSSL commonly uses Let’s Encrypt, although the exact service depends on what HostGator provides. Validation may require working DNS records or a domain-specific email address, so resolve any reported validation failure before continuing.
After issuance, return to the certificate status page and confirm that the certificate is active, valid and assigned to the correct domain. The expiry date and issuer should be visible rather than showing an error or pending state. Account access and billing remain separate from encryption, but keeping the hosting account current prevents interruptions during validation; customers can pay your HostGator invoice using the linked billing guide when payment is due.
Redirect every visit to the secure URL
The simplest option is usually cPanel’s Force HTTPS Redirect control. Open Domains, locate the domain or website in question, and enable Force HTTPS Redirect. Make sure its certificate is active before turning this on. Then enter the website address without a path and confirm that the browser moves from HTTP to HTTPS automatically.
If the control is unavailable, an .htaccess rule can perform the same task in Apache-based shared hosting. First make a backup of the existing file, then replace the placeholder hostname with the canonical domain you want visitors to use:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://www.yourdomain.com.au%{REQUEST_URI} [L,R=301]
Use the apex version instead if that is your chosen address. Keep the 301 status so the change is permanent, and retain only one HTTPS redirect rule. A WordPress plugin can also change site URLs, but using both a plugin and .htaccess for the same redirect can create a loop. Clear the WordPress cache, CDN cache and browser cache after changing URLs, then check for insecure images, scripts or styles that produce mixed-content warnings.
Test the site and check Australian requirements
Test the redirect in a private browser window and a normal window. Visit the http:// address first, then the https:// address, and confirm that the padlock or connection information appears without an error. Repeat the check on a mobile phone, since cached redirects and embedded content can behave differently in mobile Safari and Chrome. A second network can also reveal DNS or local-device problems.
For an Australian ecommerce site, test the entire customer journey rather than only the homepage. Place a test order with AUD pricing, check the ABN and business contact details, and confirm that the payment page does not return to HTTP. Customer login, contact forms, downloadable files, webmail links and any appointment booking service should all continue to work. Australian consumers expect clear local information and reliable support, while secure checkout helps protect the personal and payment details they provide.
Record the certificate expiry date and set a renewal reminder. Check the domain’s DNS status because certificate renewal can fail when nameservers are misconfigured or a domain expires. HostGator’s knowledge base, video tutorials, ticketing system and community forums can help separate a hosting issue from a browser problem. Keep screenshots of the redirect, certificate status and successful test order so that any future support request contains useful evidence.
Choose a method and use a reliable launch checklist
The main routes differ in scope. A cPanel control is suitable for most standard HostGator websites, while an .htaccess rule offers more control for unusual redirect requirements. WordPress plugins can be useful for updating site-wide URLs, but they should not duplicate server-level redirection.
| Method | Best suited to | What it handles | Main caution |
|---|---|---|---|
| cPanel Force HTTPS Redirect | Standard HostGator domains | Redirecting all HTTP visits to HTTPS | The certificate must already be active |
| cPanel AutoSSL | Issuing and renewing a certificate | Installing encryption for the domain | DNS or email validation may fail |
.htaccess 301 rule |
Custom Apache redirect requirements | Preserving paths during a permanent redirect | Incorrect syntax can cause a redirect loop |
| WordPress HTTPS plugin | Updating URLs within WordPress | Changing site and asset addresses | It may conflict with server-level settings |
Choose one primary redirect method and one canonical hostname. The certificate, redirect and application URLs then work as a coordinated setup rather than separate maintenance tasks.
- Confirm that the SSL/TLS certificate is active, valid and assigned to the correct domain.
- Choose either the
wwwor apex address as the permanent canonical hostname. - Use one permanent redirect to prevent conflicts between cPanel, plugins and
.htaccessrules. - Update internal links, images, scripts and stored HTTP URLs to their secure equivalents.
- Test forms, customer accounts, ecommerce checkout, webmail and downloadable resources.
- Record the certificate expiry date and check DNS and renewal status regularly.
Make the change during a quiet period, communicate it to anyone who maintains the website and keep a rollback copy of the affected configuration files. Your next concrete step is to open cPanel and enable Force HTTPS Redirect for the domain whose certificate you have just confirmed.