Before a site goes live.
THE CERTIFICATE
Domain resolves to our server AutoSSL run, with a padlock against the domain, www and every subdomain Expiry date some months ahead
THE REDIRECTS
One method of forcing HTTPS, not three All four URL forms reach the canonical version in a single hop The .well-known path excluded from redirects
THE APPLICATION
Site address set to the https form Permalinks re-saved Caches cleared
THE CONTENT
No mixed content warnings on the homepage No warnings on an inner page with images No warnings on any form page Padlock reported as fully secure
THE EXTRAS
Mail clients connect without certificate warnings Webmail loads securely cPanel contact address current, so failure notices arrive
TESTING
Private browsing window, several page types, and a phone.
Run an online SSL checker and confirm the chain is complete.
THE LAST STEP
Note in your records which certificate is in use and how it renews.
