--- title: "Configuring HTTPS – Magento" canonical_url: "https://www.zone.ee/help/en/kb/configuring-https-magento/" post_type: "ht_kb" published: "2026-10-14T08:10:49+00:00" modified: "2026-10-14T08:10:49+00:00" language: "en" author: "kati" taxonomies: ht_kb_category: - name: "HTTPS and SSL/TLS Certificates" url: "https://www.zone.ee/help/en/kb-categories/https-and-ssltls-certificates/" ht_kb_tag: - name: "Security" url: "https://www.zone.ee/help/en/kb-tags/security/" --- # Configuring HTTPS – Magento HTTPS is a secure connection that encrypts the information exchanged between a website visitor’s browser and the server. It helps protect usernames, passwords and data entered into forms from interception and modification. HTTPS uses the TLS protocol to protect data. A standard HTTP connection does not encrypt data, which means that someone else on an insecure network may be able to read or modify it. ### HTTPS is enabled on the server by default for a new Magento store **HTTPS is enabled on the server by default for a Magento store installed on a new web hosting account or a new subdomain.** A free Let’s Encrypt certificate and HTTP-to-HTTPS redirection are configured automatically. You do not need to enable HTTPS separately in the server management panel or order a certificate manually. For the certificate to be issued automatically, the domain or subdomain must point to the corresponding Zone server through its DNS records. However, having HTTPS enabled on the server does not always mean that Magento is configured to use HTTPS for both the storefront and the administration panel. If needed, check these settings using the instructions below. ### When do you need this guide? This guide is primarily intended for existing Magento stores that still use HTTP. A store migrated from another hosting provider may also require changes to its Magento settings, even if HTTPS is already enabled on the Zone server. **If your storefront and administration panel already use HTTPS and work correctly, you do not need to follow the steps below.** The main instructions cover Magento 2. For Magento 1, follow the older version’s instructions in step 2. Menu and setting names may vary depending on the Magento version and the language of your administration panel. ### Video tutorial – Magento 1 The video demonstrates how to configure HTTPS in Magento 1. It is in Estonian, but you can follow the steps shown on screen. Magento 2 has different menus and some different setting names. HTTPS is enabled on the server by default for new web hosting accounts and subdomains, so you do not need to repeat the certificate ordering or HTTP-to-HTTPS redirection steps shown in the video. ### 1. Check whether HTTPS is enabled on the server Open your store by entering its address starting with `https://` in your browser’s address bar, for example `https://yourdomain.ee`. If the store opens without a certificate error, HTTPS is enabled on the server and you can continue with the Magento settings. If Magento still uses HTTP addresses in its settings, store links may lead back to HTTP or the store may redirect you there. If HTTPS is not yet enabled on your web hosting account or subdomain, install a free certificate by following the guide [HTTPS and a free SSL certificate – Let’s Encrypt](https://www.zone.ee/help/en/kb/https-and-free-ssl-certificate-lets-encrypt/). After the certificate has been issued, HTTPS activation may take up to 15 minutes. If your browser displays a certificate error, resolve it before proceeding with the next steps. If needed, contact [Zone’s customer support](mailto:info@zone.ee). ### 2. Configure Magento to use HTTPS Before making changes, back up your store’s files and database. #### Magento 2 1. Log in to your Magento administration panel. 2. Open `Stores` → `Settings` → `Configuration`. 3. In the left panel, select `General` → `Web`. 4. Expand `Base URLs (Secure)`. 5. Make sure that `Secure Base URL` contains your store’s full HTTPS address, for example `https://yourdomain.ee/`. 6. Set both of the following options to `Yes`: - `Use Secure URLs on Storefront`; - `Use Secure URLs in Admin`. 7. Click `Save Config` to save your changes. **The base URL must end with a forward slash `/`.** If Magento is installed in a subdirectory, keep that directory in the address, for example `https://yourdomain.ee/store/`. Do not change the placeholders in `Base Link URL` and `Secure Base Link URL`, or the separate administration panel URL or path. In a standard configuration, you do not need to change the static file and media URL fields either if they use base URL placeholders. If your Magento installation manages multiple websites or store views, make sure you are editing the settings for the correct website or store view. If needed, ask your store administrator for help. If some store links still lead to HTTP addresses after saving the changes and clearing the cache, also check the `Base URL` field under `Base URLs`. If needed, change the beginning of the address from `http://` to `https://`, leaving the rest unchanged. #### Magento 1 1. Log in to your Magento administration panel. 2. Open `System` → `Configuration`. 3. In the left panel, select `General` → `Web`. 4. Expand `Unsecure` and `Secure`. 5. Change the `Base URL` in both sections to your store’s HTTPS address, for example `https://yourdomain.ee/`. Keep the rest of the address and the trailing forward slash unchanged. 6. Under `Secure`, set `Use Secure URLs in Frontend` and `Use Secure URLs in Admin` to `Yes`. 7. Click `Save Config` to save your changes. If the required HTTPS addresses and settings are already configured, you do not need to change them again. ### 3. Clear the Magento cache After saving the settings, clear the Magento cache so that your store uses the updated configuration. - **Magento 2:** open `System` → `Tools` → `Cache Management`. - **Magento 1:** open `System` → `Cache Management`. Click `Flush Magento Cache`. Then reload your store in the browser. If needed, log in to the administration panel again using its HTTPS address. ### 4. Update addresses in your store’s content if needed Your store’s content may still contain HTTP references, for example images added to content pages or content blocks. These references may also appear in payment method logos in the footer. If a resource does not load or causes a mixed content warning, change its address from HTTP to HTTPS in the relevant content. For example, replace `http://yourdomain.ee/image.jpg` with `https://yourdomain.ee/image.jpg`. Before changing an address, check that the resource is available over HTTPS. An address belonging to another website cannot always be changed to HTTPS simply by editing its prefix. If many references need updating or you cannot find where they are stored, ask your store administrator or developer for help. ### 5. Check that your store works correctly Open your store using its HTTPS address and check several pages. Make sure that the homepage, categories, product pages, shopping cart and checkout work correctly. Also check images, the layout, menus, forms, customer account login and administration panel login. The browser should not display certificate errors or mixed content warnings. If an element does not load or the browser displays a *mixed content* warning, the theme or an extension may contain HTTP references to images, fonts, CSS or JavaScript files. Fixing these references may require changes to the theme or extension settings or files. If you have not edited these files before, ask your store administrator or developer for help. Proceed to the next step only once your store works correctly with HTTPS. ### 6. Check HTTP-to-HTTPS redirection HTTP-to-HTTPS redirection is enabled by default on new web hosting accounts and subdomains. To check it, open your store using its HTTP address, for example `http://yourdomain.ee`. Your browser should automatically redirect you to `https://yourdomain.ee`. If redirection is not enabled, enable it only after updating the Magento settings and checking that your store works correctly with HTTPS. Open **`My Zone`** → **`Manage`** → **`Webserver`**. Under **`Main domain settings`** or **`Subdomains`**, click **`Redirect traffic to HTTPS`** for the relevant domain. This redirects all HTTP addresses on your store to their corresponding HTTPS addresses using a permanent 301 redirect. It also tells search engines that your store’s addresses now use HTTPS.