BigCommerce includes a free SSL certificate for every store, both on the default bigcommerce.com subdomain and connected custom domains, with certificate issuance and renewal handled automatically.
Where to check enforcement
Under Settings → Store Settings → Security, confirm HTTPS is enforced site-wide rather than only on checkout pages — some older configurations from migrated stores only force it on cart and checkout, leaving the rest of the storefront on plain HTTP.
Custom domains specifically
If you're using a custom domain rather than the default BigCommerce subdomain, certificate issuance can take up to 24 hours after DNS is correctly pointed. Check the SSL status in the same security settings panel to confirm it's issued before troubleshooting further.
Why enforcement scope matters more on BigCommerce than the toggle alone suggests
Some older BigCommerce store configurations, particularly ones migrated from earlier platform versions, only enforce HTTPS on cart and checkout pages by default rather than site-wide — explicitly confirming the enforcement setting covers the entire storefront, not just the transactional pages, is worth checking specifically on any store that's existed for several years.
What BigCommerce's app marketplace means for third-party HTTPS considerations
Apps installed from BigCommerce's marketplace sometimes inject their own scripts or embeds that can carry hardcoded http:// references from an older integration — reviewing installed apps specifically for outdated asset URLs is worth doing alongside the core storefront check, since app-injected content isn't always covered by BigCommerce's own core HTTPS settings.
Why checking your theme's hardcoded assets matters even on a managed platform
Even with BigCommerce handling certificate issuance automatically, a custom or heavily modified theme can still contain hardcoded http:// references in its own template files — reviewing custom theme code specifically, not just core platform settings, catches this category of issue that platform-level HTTPS enforcement alone won't fix.
What BigCommerce's Stencil theme framework means for HTTPS-related customization
Stores built on BigCommerce's modern Stencil theme framework generally handle protocol-relative asset references more consistently than older Blueprint-based themes, meaning newer BigCommerce stores are somewhat less prone to mixed content issues than stores running legacy theme code carried over from years ago.
How BigCommerce's headless commerce option changes the HTTPS picture
Stores using BigCommerce as a headless backend, with a separate custom frontend built independently, need to handle HTTPS configuration for that custom frontend entirely separately from BigCommerce's own backend API, which has its own independent, already-secured HTTPS endpoints.
What to check in your store's robots.txt and sitemap after migration
Confirming your store's sitemap.xml references https:// URLs and that robots.txt isn't inadvertently blocking search engines from the newly migrated URLs are both quick, easy checks worth adding to a BigCommerce migration checklist alongside the core HTTPS settings themselves.
A closing thought on managed e-commerce platforms and HTTPS specifically
BigCommerce's approach reflects a broader pattern among managed e-commerce platforms generally: HTTPS is treated as core, non-optional infrastructure bundled with hosting rather than a separate product decision — a meaningful shift from a decade ago when even commerce sites sometimes had to actively seek out and pay for SSL separately.
What a BigCommerce store owner should prioritize checking first after migration
Checking that HTTPS enforcement covers the entire storefront rather than only checkout, and that any custom theme code doesn't reference hardcoded http:// assets, are the two highest-value checks to prioritize immediately after any BigCommerce HTTPS-related change.
How BigCommerce's approach compares to Shopify's similarly managed model
Both platforms handle certificate issuance and renewal automatically with minimal owner involvement, reflecting a broadly similar managed-hosting philosophy — the practical differences between them lie more in theme customization and app ecosystem than in how either handles HTTPS specifically.