Add the Padlock

"Not Secure" scares people off

The padlock means HTTPS: everything between a visitor's browser and your VPS is scrambled so nobody in between can read it.

Without it, browsers flag your site as Not Secure right in the address bar. With it, that warning disappears and a little lock shows up instead. It used to cost money and take real know-how. Now a nonprofit called Let's Encrypt gives certificates away for free, and a tool called Certbot does the entire job for you in one command.

Install Certbot

Back on your VPS, as your regular user:

Get your certificate

One command does everything: proves you own the domain, gets the certificate, and wires it into Apache.

1. 1It'll ask for an email — that's just so Let's Encrypt can warn you if something ever needs attention.
2. 2When it asks about redirecting HTTP to HTTPS, choose yes. That way anyone who types the old http:// address gets bounced straight to the secure one automatically.

Refresh your site:

Let it take care of itself

These certificates expire every 90 days — on purpose, for safety. You don't have to remember that.

Certbot quietly set up its own alarm clock during install, one that renews the certificate automatically around day 60, long before it ever expires. You can check that alarm actually works without changing anything for real:

What's true now

• ✓
  HTTPS is ona free Let's Encrypt certificate, installed by Certbot
• ✓
  Both the root domain and www are covered-d yourdomain.com -d www.yourdomain.com
• ✓
  Old http:// links redirect automaticallychosen during setup
• ✓
  Renewal happens on its ownno reminders, no manual work