Serve everything over HTTPS

How to do it

Get certificates automatically with ACME, such as Let's Encrypt, for every host name. Serve the full chain. Redirect http:// to https:// on the same host name with a 301. Move between www and the bare domain only after that, over HTTPS, because the HSTS preload list requires it.

Example

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  server_name example.com;
  ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

How to check

SSL Labs or testssl.sh gives grade A or better. curl -sI http://www.example.com/ answers 301 with location: https://www.example.com/.