The Force HTTPS setting under Site Settings → Security ensures every visitor lands on an HTTPS URL. If they hit the HTTP version of your site, they're 301-redirected to HTTPS automatically and the redirect is permanent (browsers cache it).
For any production deployment in 2025, this should always be on. Modern browsers warn users about HTTP-served sites, search engines downrank them, and many platform features (Service Workers, push notifications, the Geolocation field, camera access for the Screen/Media Recorder field) require HTTPS at the browser level.
What it does
The platform reads the request scheme (HTTP vs HTTPS) on every page load. If it's HTTP and Force HTTPS is on, the response is a 301 Moved Permanently to the same URL on HTTPS. The redirect happens before any application logic runs, so it's fast and consistent across every page on the site.
Sessions and cookies are preserved through the redirect — the user's existing session continues seamlessly on the HTTPS side. New cookies are flagged Secure (so they only travel over HTTPS) and HttpOnly (so JavaScript can't access them), which prevents a whole class of cookie-theft attacks.
What it requires
The platform doesn't issue or manage TLS certificates itself — that's a deployment concern. You need:
- A valid TLS certificate installed at the web-server level (Apache, Nginx) or at the load balancer / CDN level (AWS ALB, CloudFront, Cloudflare).
- DNS pointing your domain at the host serving HTTPS.
- The certificate's hostname matching your site's hostname (no wildcard mismatches).
Common ways to get a certificate, in order of typical preference: a free Let's Encrypt cert managed by Certbot, a managed certificate from AWS Certificate Manager (free for traffic going through ALB or CloudFront), a paid wildcard certificate from a vendor like DigiCert (for organisations with strict policies).
Mixed-content gotcha
One common pitfall: after enabling Force HTTPS, pages might still reference HTTP-only resources (images, scripts, fonts) hard-coded in your templates or content. Modern browsers block these as "mixed content" — the page loads but the resources don't.
Three places to check after enabling:
- Image URLs in articles and email templates — use the browser's developer-tools network tab to spot HTTP requests.
- Hard-coded URLs in custom JavaScript — search your custom code for
http://. - External resources you embed — Google Fonts, third-party widgets, embedded videos. Update to HTTPS variants if they exist.
Tip: Use protocol-relative URLs (e.g.//example.com/image.pnginstead ofhttp://example.com/image.png) for resources you reference from both HTTP and HTTPS contexts. Browsers fetch them via whichever protocol the parent page is using.
HSTS — going one step further
For maximum security, pair Force HTTPS with HTTP Strict Transport Security (HSTS) — an HTTP header that tells browsers to never connect over HTTP for this domain, even if the user types http://. HSTS is configured at the web server / load balancer level rather than inside ActiveManage; once set up the browser caches the directive and the only requests that ever go out are HTTPS.