-2

If I simply type in security.stackexchange.com into my browsers URL bar, it uses HTTPS to fetch data from the server.

Is it possible for a website to not work over HTTPS? Does it have to be configured manually from the server side by the owner of the website, or does it just work automatically for all websites?

closed as unclear what you're asking by S.L. Barth, Tobi Nary, forest, ThoriumBR, Xander Sep 11 '18 at 12:24

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Are you asking if it's recommended to 301 redirect to the HTTPS version of a site? – forest Sep 6 '18 at 8:40
  • Please clarify what do you mean : Is it possible that one of the website - not working with HTTPS – mootmoot Sep 6 '18 at 9:44
  • This meta post and its links give you a brief outline of what was required to HTTPS-ify Stackexchange. Although small and unimportant websites with few users are often easier. – dave_thompson_085 Sep 7 '18 at 5:13
  • The question is about to ask that this is normal or not normal if a webpage is working with 'http://' but not working 'https:// '. Thanks. – MrSeelvuple Sep 7 '18 at 12:23
1

Whether HTTP and HTTPS work at all depends on your hosting provider. Almost all hosting providers provide a HTTP version of a site, but not all providers support HTTPS. If you try to connect to https://yoursite.com/ you may get an error message:

  • "Connection refused" indicates that the server does not support HTTPS at all. Your browser tries to connect on port 443, but the server does not accept connections on that port.
  • "Your connection is not secure" indicates that the server does support HTTPS, but it does not provide the correct certificate for your site.

Sites that support HTTPS may want users to always use the HTTPS version, and never the HTTP version. There are some ways to ensure this:

  • If the user connects to HTTP, immediately redirect them to the HTTPS version.
  • On the HTTPS version, respond with a Strict-Transport-Security header to indicate that HTTPS should be used from now on.

Not the answer you're looking for? Browse other questions tagged or ask your own question.