Unencrypted traffic exposes your users to man‑in‑the‑middle attacks. Setting up HTTPS is now mandatory for any serious site. With Let’s Encrypt, it’s also free.
1. Obtain a certificate
Use Certbot to request a certificate from Let’s Encrypt. It will automatically configure Apache if you let it.
sudo apt install certbot python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com
2. Harden TLS settings
Edit your ssl.conf to disable weak protocols and ciphers. Enforce HTTP/2 and strong Diffie-Hellman parameters.
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite HIGH:!aNULL:!MD5
SSLHonorCipherOrder on
3. Redirect HTTP to HTTPS
Make sure all HTTP traffic is redirected to HTTPS to prevent downgrade attacks. Use a 301 redirect in your virtual host configuration.