How do I get HTTPS?
You need a certificate, and almost every host now provides one free, often through a service called Let's Encrypt. Once it is installed, set the site to redirect every http:// address to https://, so nobody stays on the insecure version.
What is mixed content?
A secure page that loads some of its files, such as an image or a script, over an insecure connection. Browsers block or warn about these, which can break parts of the page and remove the padlock. The fix is to change those file addresses from http:// to https://.
Which security headers matter most?
Two are quick wins that every site should send.
- Strict-Transport-Security: tells browsers to always use https for your site.
- X-Content-Type-Options: nosniff, which stops browsers guessing file types in unsafe ways.
- Content-Security-Policy is stronger still, but needs care to set up without breaking the site.
What should I ask my host or developer?
Ask them to confirm three things: that a certificate is installed and renews automatically, that http and www addresses redirect to the https address, and that the two headers above are sent on every page.