Example
All websites on Webflow's hosting are served over HTTPS automatically — the padlock icon confirms the encrypted connection.
As of 2024, over 95% of pages loaded in Chrome use HTTPS — and Google now labels all HTTP pages as 'Not Secure,' making HTTPS a baseline requirement for any credible website, according to Google Transparency Report.
What it applies to
Every public-facing website — especially any page that collects user input (forms, logins, payments). HTTPS is a non-negotiable baseline requirement for security, SEO, and user trust.
How HTTPS works
- When a browser connects to an HTTPS site, it initiates a TLS handshake — an exchange of cryptographic keys that establishes a secure, encrypted channel.
- All data transmitted between the browser and server is encrypted — form submissions, login credentials, payment details, and cookie values are unreadable to anyone intercepting the connection.
- The SSL/TLS certificate proves the server's identity — the browser verifies it was issued by a trusted Certificate Authority (CA) and that it matches the domain being visited.
How to enable HTTPS
- On managed hosting (Webflow, Netlify, Vercel): HTTPS is automatic — the platform provisions and renews SSL certificates via Let's Encrypt with no action required.
- On self-managed servers: Install a free Let's Encrypt certificate using Certbot, or purchase an OV/EV certificate from a CA like DigiCert for higher validation levels.
- Set up a 301 redirect from all HTTP URLs to their HTTPS equivalents to ensure no traffic reaches the unsecured version.
%20(1).png)