Netlify provisions free SSL certificates automatically (via Let's Encrypt) for both netlify.app subdomains and connected custom domains, with HTTPS enforced by default.
Confirming it's on
Under Site settings → Domain management → HTTPS, confirm "Force HTTPS" is enabled — it's on by default, but worth checking after a domain change, since Netlify needs to first verify certificate issuance completed for the custom domain before enforcement is safe to enable.
If a custom domain isn't showing HTTPS yet
Certificate provisioning can take a few minutes to a few hours after DNS is correctly pointed at Netlify — check the HTTPS section of the same settings panel, which will show the certificate's current status.
Why Force HTTPS is on by default but still worth confirming after changes
While Force HTTTPS defaults to enabled for new sites, a domain change, a DNS migration, or a custom domain reconnection can sometimes reset or affect this setting — a quick check in the HTTPS section of your site settings after any domain-related change confirms it's still correctly configured.
What a pending certificate status actually means for a new custom domain
A newly connected custom domain shows a pending status while Netlify's automated Let's Encrypt integration completes issuance, typically resolving within minutes to a few hours — if it remains pending far longer, the underlying cause is almost always a DNS configuration issue preventing Netlify from completing domain validation.
What happens to the redirect setting during a domain transfer
Transferring a custom domain's DNS management, moving from one registrar to another, for example, doesn't affect Netlify's HTTPS or redirect configuration, which remains tied to the site configuration itself rather than the domain's registrar — no action needed on the redirect settings specifically during a pure DNS provider change.
What Netlify's deploy previews mean for testing HTTPS behavior before going live
Every deploy preview Netlify generates for a branch or pull request receives its own automatically issued certificate on a preview subdomain, letting you verify HTTPS-dependent behavior in a realistic, secured environment before merging changes to production.
How Netlify Forms and Functions are affected by the domain's HTTPS status
Netlify's Forms and Functions features operate correctly regardless of your custom domain's specific HTTPS provisioning status, since they're served from Netlify's own already-secured infrastructure — though your site's own pages submitting to these features should still reference them via HTTPS to avoid mixed content warnings.
Why Netlify's redirect rules file can interact with the platform's own HTTPS handling
A custom _redirects file or netlify.toml redirect configuration operates alongside, not instead of, Netlify's platform-level HTTPS enforcement — custom redirect rules you define are for your own application routing needs, while the HTTPS-specific redirect remains handled automatically by the platform itself.
A closing note on Netlify's overall approach to this entire category of configuration
Netlify's design philosophy throughout, sensible defaults that work correctly with zero configuration, paired with the flexibility to override when genuinely needed, is a useful model to keep in mind when evaluating other platforms' approaches to HTTPS handling.
What Netlify's team and enterprise plans add regarding certificate options
Netlify's higher-tier plans add support for custom certificate uploads and more advanced domain management options beyond the automatic Let's Encrypt provisioning covered in this guide, relevant primarily for organizations with specific compliance requirements around certificate validation level.
How this guide applies identically to a Netlify site built with any frontend framework
Netlify's HTTPS and redirect handling operates at the hosting and CDN layer, entirely independent of which frontend framework (React, Vue, plain HTML, or any other) generated your site's build output — no framework-specific configuration is needed for the HTTPS behavior itself.