People with admin permissions for a repository can enforce HTTPS for a GitHub Pages site.
All GitHub Pages sites, including sites that are correctly configured with a custom domain, support HTTPS and HTTPS enforcement. For more information about custom domains, see "About custom domains and GitHub Pages" and "Troubleshooting custom domains and GitHub Pages."
GitHub Pages sites shouldn't be used for sensitive transactions like sending passwords or credit card numbers.
Warning: GitHub Pages sites are publicly available on the internet by default, even if the repository for the site is private or internal. If your project site is published from a private or internal repository owned by an organization using GitHub Enterprise Cloud, you can manage access control for the site. In an enterprise with managed users, all GitHub Pages sites are privately published. Otherwise, if you have sensitive data in your site's repository, you may want to remove the data before publishing. For more information, see "About repositories" and "Changing the visibility of your GitHub Pages site."
Note: RFC3280 states that the maximum length of the common name should be 64 characters. Therefore, the entire domain name of your GitHub Pages site must be less than 64 characters long for a certificate to be successfully created.
On GitHub, navigate to your site's repository.
Under your repository name, click Settings.
In the left sidebar, click Pages.
Under "GitHub Pages," select Enforce HTTPS.
To remove your site's mixed content, make sure all your assets are served over HTTPS by changing
https:// in your site's HTML.
Assets are commonly found in the following locations:
- If your site uses Jekyll, your HTML files will probably be found in the _layouts folder.
- CSS is usually found in the
<head>section of your HTML file.
<head>section or just before the closing
- Images are often found in the
Tip: If you can't find your assets in your site's source files, try searching your site's source files for
http in your text editor or on GitHub.