How to Add HTTPS to a Static Site

Quick answer
The easiest path is hosting on Netlify, Vercel, Cloudflare Pages, or GitHub Pages — HTTPS is automatic and free.
On your own server, Let’s Encrypt issues free certificates that auto-renew.
A site without HTTPS is marked ‘Not secure’ in browsers and breaks many browser features.

How do I get HTTPS for free on a managed host?

Deploy the site to Netlify, Vercel, Cloudflare Pages, or GitHub Pages and add a custom domain in the dashboard. These platforms provision a Let’s Encrypt certificate automatically and renew it for you. No server, no certbot, nothing to maintain — this is the right path for a static site.

How do I add HTTPS on my own server?

Install certbot, point your DNS A record at the server, then run certbot with your web server. The command below issues a certificate and wires auto-renewal for nginx. A cron or systemd timer re-runs renew twice a day; certbot renews only when a certificate is close to expiring.

# Install and run certbot for nginx (Ubuntu/Debian)
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

# Test that renewal works
test -f /etc/letsencrypt/live/example.com/fullchain.pem && echo OK

What does ‘it worked’ look like?

Load https://example.com and confirm the browser shows a padlock and no ‘Not secure’ warning. Check the certificate’s expiry date — it should be about 90 days out, and the auto-renew timer should be active. If you see a ‘Not secure’ warning, the certificate is missing, expired, or your domain name doesn’t match it.

Where this bites vibecoders
Managed platforms make HTTPS invisible, so many vibecoders never learn it exists — until they deploy a VPS-based app and the AI assistant says to use a self-signed certificate or skip HTTPS ‘for now’. A self-signed cert makes browsers show a full-page warning, and skipping TLS means passwords and API keys cross the network in plaintext. Certbot fixes this in one command.

Where AI coding assistants get this wrong

Generating a self-signed certificate when Let’s Encrypt would work — browsers distrust it.
Issuing one certificate for example.com but serving requests for www.example.com without it.
Forgetting the renewal timer, so the site silently breaks 90 days later.
Putting certbot on the same machine as the app without documenting how to renew.

Checklist

Use a managed host and skip server-side HTTPS setup entirely when possible.
On your own server, use Let’s Encrypt + certbot, never a self-signed cert.
Verify both the apex domain and www resolve and serve HTTPS.
Confirm auto-renewal is scheduled and test the renewal command.

FAQ

Is a free certificate from Let’s Encrypt as good as a paid one?

Yes for encryption. Let’s Encrypt certificates are trusted by every major browser and provide the same TLS encryption as paid certificates. Paid certificates mainly add longer validity and human support, which most sites don’t need.

Why does my browser still say ‘Not secure’ after adding HTTPS?

Usually one of: the certificate was issued for a different domain, it has expired, or the page mixes HTTP resources (images, scripts) into an HTTPS page. Fix the mismatch and re-check; mixed content blocks most browser features too.