How to Set Up HTTPS for Self-Hosted Websites (SSL & Cloudflare Guide)

HTTPS is no longer optional. In 2025, every self-hosted website must use HTTPS to protect user data, improve SEO rankings, and avoid browser “Not Secure” warnings.

This guide explains how to set up HTTPS correctly for self-hosted websites using SSL certificates, Let’s Encrypt, and Cloudflare. You’ll also learn how HTTPS works, common mistakes developers make, and how to secure your site the right way.

HTTPS is mandatory for security and SEO. This guide explains SSL certificates, HTTPS handshakes, and common mistakes developers make while enabling HTTPS.

We also cover how Cloudflare simplifies HTTPS for self-hosted servers.

• Public-Facing with Let’s Encrypt (Recommended): Use Let’s Encrypt for free, globally trusted certificates. This requires a domain name pointed at your server’s public IP.
• Cloudflare Tunnels (Simplest for Home Servers): Use Cloudflare Tunnel to expose local services to the internet securely without port forwarding on your router. Cloudflare handles the SSL/TLS termination automatically.
• Strictly Internal (Local Only): Use a tool like mkcert to create locally trusted certificates for development or private home labs. 

1. Domain Setup: Register a domain and create an A record pointing to your server’s IP address.
2. Open Ports: Ensure ports 80 (HTTP) and 443 (HTTPS) are open on your server’s firewall and forwarded on your router.
3. Install Certbot: Use Certbot, the standard ACME client, to automate certificate issuance and renewal.
   • Command: sudo certbot --nginx (or --apache).
4. Automatic Renewal: Verify that a cron job or systemd timer is active to renew certificates every 90 days. 

• Force HTTPS: Configure a 301 redirect from HTTP to HTTPS in your server’s configuration file (e.g., return 301 https://$host$request_uri; for Nginx).
• Enable HSTS: Add the Strict-Transport-Security header to force browsers to always use HTTPS for your domain.
• Update Protocols: Disable outdated protocols like TLS 1.0 and 1.1; ensure TLS 1.2 and TLS 1.3 are enabled.
• Check for Mixed Content: Use browser developer tools (F12) to ensure all scripts, images, and CSS are loaded over https:// to avoid browser warnings.