HTTPS not working

Updated 9 October 2026

Short answer

If http:// works but https:// doesn't, the server isn't set up to serve secure connections: no valid certificate is installed, or port 443 isn't open. If HTTPS "works" but keeps redirecting, or shows a "too many redirects" error, two settings are fighting over the redirect, very often your server and Cloudflare. If the padlock is missing on a page that does load, that's mixed content.

What's the problem

The https:// version of your site doesn't load, shows a warning, loops between pages, or loads without a padlock. Or http:// doesn't redirect to https://.

Why it happens

  • No certificate on the server, or an expired or wrong one.
  • Port 443 is closed in the server's firewall or not configured in the web server.
  • Redirect loop: the server redirects HTTP to HTTPS while Cloudflare, in Flexible mode, talks to the server over HTTP, so every request gets redirected again.
  • No HTTP to HTTPS redirect, so visitors who type the address land on the insecure version.
  • Pages load insecure files (images, scripts) over HTTP, so the padlock disappears.

How to fix it

  1. Check a certificate is installed and valid for the domain.
  2. Check port 443 is open and your web server is configured to listen on it.
  3. If you use Cloudflare and see a redirect loop, set the SSL mode to Full (or Full strict with a valid server certificate), or remove the HTTPS redirect from your server.
  4. Add one HTTP to HTTPS redirect, in one place only: either the server or Cloudflare's "Always Use HTTPS".
  5. Once HTTPS works everywhere, consider HSTS so browsers always use the secure version.
  6. Fix any insecure resources so every page shows the padlock.

What Preventionlabs checks

One click runs the full report on your domain. For this problem it shows whether HTTPS works and http visitors are sent to it; every version of your address (http, https, www) and where each ends up, including redirect loops; insecure http:// files on any of up to 50 pages; your DNS: nameservers, addresses, DNSSEC, and records pointing at services that no longer exist. With Cloudflare connected, it also shows your certificate and the days until it expires; your SSL mode and the other settings that commonly cause this.

Run your free report

Your first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.

Sources

  1. MDN Web Docs: Strict-Transport-SecurityreferenceThe HTTP Strict-Transport-Security response header (often abbreviated as HSTS ) informs browsers that the host should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be upgraded to HTTPS.
  2. Cloudflare: ERR_TOO_MANY_REDIRECTSofficial docsIf your domain's encryption mode is set to Flexible , Cloudflare sends unencrypted requests to your origin server over HTTP.

Related

"Your connection is not private" The browser couldn't verify your site's certificate: it's expired, for the wrong domain, or not trusted. Fix or renew it on your server. Redirect loop Two settings keep sending visitors back and forth. Most often an HTTPS redirect on your server fighting Cloudflare's Flexible SSL, or www rules that disagree. Mixed content error Your secure (HTTPS) page loads some files over insecure HTTP. Browsers block them or drop the padlock. Change those links to HTTPS. SSL handshake failed Your server and the browser or Cloudflare couldn't agree on a secure connection: no certificate, wrong SSL mode, or outdated TLS only.
← All of SSL and HTTPS