Certificates can be free (Let’s Encrypt) or purchased with extended validation. Automated renewal avoids the classic “certificate expired” outage.
Mixed content—HTTP assets on an HTTPS page—triggers browser warnings and hurts trust. After migration, scan for old image or script URLs.
HSTS and redirects from HTTP to HTTPS should be part of launch checklists, not an afterthought.