How to Verify Joomla Is Using HTTPS Correctly
Confirm the certificate and hostname first
Open the site's canonical https:// address in a clean browser session and confirm there is no certificate warning. Check that the certificate covers the hostname visitors actually use, including the www or non-www form selected for the site. A valid Joomla configuration cannot compensate for an expired, mismatched, or incorrectly installed TLS certificate.
Verify Joomla's Force HTTPS setting
In Administrator, open System → Setup → Global Configuration and review the Server tab. Joomla's Force HTTPS option can enforce HTTPS for the Administrator area or the entire site, but the server must already support HTTPS correctly. For a normal public site intended to be fully encrypted, verify that the selected setting matches the site's actual redirect design.
Test HTTP-to-HTTPS redirection
Request several http:// URLs, including the home page and a deeper article or component route. Confirm each request reaches the corresponding https:// URL without a loop, lost path, or lost query string. If a CDN, reverse proxy, hosting panel, or web server also performs redirects, make sure the layers agree about the original request scheme.
Inspect the final response and browser security state
Use browser developer tools to confirm the final document is delivered over HTTPS and that important scripts, stylesheets, fonts, images, and API calls also use secure URLs. Mixed-content warnings mean the page is not fully secure even though the address bar begins with https://. Correct hard-coded insecure resource URLs at their source.
Check logins, forms, and secure cookies
Test the Administrator login, frontend login, contact or account forms, and other authenticated workflows over HTTPS. Joomla's Force HTTPS behavior includes secure-cookie handling, so verify sessions remain stable after redirects and that users are not bounced between HTTP and HTTPS. Proxy misconfiguration can cause repeated login or redirect symptoms.
Verify canonical and integration URLs
Check canonical links, sitemap URLs, outbound callbacks, payment return URLs, webhooks, API endpoints, and email links that are generated by Joomla or extensions. Old http:// values can survive in extension configuration or content after HTTPS is enabled. Update only confirmed stale values rather than performing an indiscriminate database replacement.
Retest from outside the Administrator session
Use a private window or an external HTTP inspection tool to test the public path as an ordinary visitor. Verify the certificate, redirect chain, final status, and secure resources without relying on cached browser state. A correct result is consistent HTTPS delivery across guest, authenticated, and Administrator workflows without loops or mixed content.
Need More Help with Joomla?
Still having trouble? Open a support ticket with QuantaCade Support and we'll be happy to help where we can.
Support priority is given to QuantaCade products, services, and customers. However, we're also happy to assist fellow Joomla users with general Joomla questions and troubleshooting when possible.
QuantaCade is an independent Joomla extension developer and is not official Joomla support. Some issues involving third-party extensions, hosting environments, server configurations, or other systems outside our development control may be beyond what we're able to resolve.