---
title: "Serve everything over HTTPS · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/hosting-and-network/https-tls
updated: 2026-10-20
licence: "All rights reserved"
---

# Serve everything over HTTPS

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)
- Rule: Serve every page over HTTPS, the encrypted web, using TLS 1.2 or 1.3 and a valid certificate chain. Redirect plain HTTP to HTTPS.
- How: Get certificates automatically with ACME, such as Let's Encrypt, for every host name. Serve the full chain. Redirect `http://` to `https://` on the same host name with a 301. Move between `www` and the bare domain only after that, over HTTPS, because the HSTS preload list requires it.
- Check: SSL Labs or `testssl.sh` gives grade A or better. `curl -sI http://www.example.com/` answers 301 with `location: https://www.example.com/`.

Example:

```nginx
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  server_name example.com;
  ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/https-tls`.

- Next: [Turn off old encryption](https://agentwranglers.se/playbook/website/hosting-and-network/tls-configuration)
- [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)