Forcing HTTPS and choosing www or non-www

Once an SSL certificate is installed, open Admin › Security and access › Hardening:

• Force HTTPS redirects every http:// request to https://.
• Canonical domain either always adds www. or always removes it.

Redirects are permanent (301) for normal page visits, which is what search engines expect. If your site is behind a CDN or proxy, make sure it passes the X-Forwarded-Proto header. These options never affect localhost or IP addresses, so you cannot lock yourself out while testing.