After installing an SSL certificate, you should ensure that all visitors access your website securely via HTTPS. Plesk provides several options to enforce HTTPS, including permanent redirects from HTTP to HTTPS and a security header that tells browsers to always use HTTPS.

### Enabling Permanent HTTPS Redirect

1. Log in to **Plesk**.
2. Go to **Websites & Domains** → click your domain.
3. Go to **Hosting & DNS** → **Hosting Settings**.
4. Find **Permanent SEO-safe 301 redirect from HTTP to HTTPS**.
5. Check the box to enable it.
6. Click **OK**.

Now all visitors who type `http://yourdomain.com` will be automatically redirected to `https://yourdomain.com`.

### Enabling HSTS (HTTP Strict Transport Security)

HSTS tells browsers to always connect to your site via HTTPS, even if the user types `http://`:

1. Go to **Websites & Domains** → click your domain.
2. Go to **Hosting & DNS** → **Hosting Settings**.
3. Find **Enable HSTS**.
4. Check the box to enable it.
5. Click **OK**.

**Warning:** Once HSTS is enabled, browsers will refuse to connect to your site via HTTP for the duration of the header. If you need to disable SSL temporarily, you may lock visitors out. Use with caution.

### Setting HTTPS as Default in Plesk

1. Go to **Websites & Domains** → click your domain.
2. Go to **Hosting & DNS** → **Hosting Settings**.
3. Under **SSL/TLS support**, select **Redirect from HTTP to HTTPS** (if available).
4. Click **OK**.

### Important Notes

- The 301 redirect is **SEO-safe** — search engines will update their index to use HTTPS.
- Ensure your SSL certificate is properly installed and covers all subdomains before enabling permanent redirects.
- After enabling HSTS, submit your site to the **HSTS Preload List** (`hstspreload.org`) for maximum security.

### Troubleshooting

**Redirect loop (infinite redirect):**

- This can happen if you have conflicting redirect rules. Check your **Apache & nginx Settings** for custom redirect directives.
- Clear the redirect setting, save, then re-enable it.

**Some pages load without HTTPS:**

- Check for **mixed content** — your pages may be loading resources (images, scripts) over HTTP. Use your browser developer tools to identify mixed content.

### Related Guides

- [Install a free SSL first](/hc/help/en/articles/how-to-install-a-free-let-s-encrypt-ssl-in-plesk)
- [Use a custom certificate](/hc/help/en/articles/how-to-upload-a-custom-ssl-certificate-in-plesk)
- [Remove an old cert](/hc/help/en/articles/how-to-remove-an-ssl-certificate-from-your-domain-in-plesk)