Site runs only on unencrypted HTTP

What it is

Your site responds on http://, but not on https://. Either port 443 is closed, or no web server is running on it. Visitors communicate with your site in readable form — without encryption.

Why it’s a problem

Without HTTPS, all communication travels across the network in the open. Passwords, cookies, form contents, card numbers — anyone between you and the visitor (the Wi-Fi provider, ISP, hosting neighbor) can read them and even alter them on the fly.

The second problem is trust. Both Chrome and Firefox now visibly flag a site without HTTPS as not secure. You also pay for it in SEO — Google has ranked HTTPS sites higher since 2014.

How to fix it

Step 1 — get a certificate

For most sites, Let’s Encrypt is enough. It’s free, renews automatically, and is supported by all modern browsers.

• Shared hosting (Wedos, Forpsi, Active24, Webglobe...): in the control panel you’ll find an “Activate HTTPS” or “Let’s Encrypt” button. One click.
• Your own VPS / dedicated server: use certbot (sudo certbot --nginx) or acme.sh.
• Cloudflare or another CDN/WAF: Cloudflare offers Universal SSL for free. You enable it in a single click.

Step 2 — redirect HTTP → HTTPS

So that no one keeps the old http:// URLs, the server must permanently redirect every visitor (HTTP 301) to the HTTPS version.

# nginx
server {
    listen 80;
    server_name example.cz www.example.cz;
    return 301 https://$host$request_uri;
}

Step 3 — enable HSTS

The HSTS header tells the browser “never visit this site over HTTP again”. For details see Strict-Transport-Security.

References

• Let’s Encrypt
• web.dev: Why HTTPS matters
• MDN: Strict-Transport-Security