How to Enable SSL & HTTPS on WordPress (Complete Step-by-Step Guide)
Having an SSL certificate installed on your WordPress website is no longer optional—it is an absolute necessity. Major web browsers like Google Chrome, Firefox, and Safari flag any HTTP website as "Not Secure", scaring away potential customers and harming your search engine rankings.
In this guide, we will walk you through everything you need to know to enable SSL and redirect your WordPress site to HTTPS smoothly without breaking your site or losing traffic.
Why You Need SSL/HTTPS on Your WordPress Site
SSL (Secure Sockets Layer) encrypts the connection between your website visitors' browsers and your web server. Here is why it is critical:
Data Protection: Encrypts sensitive data like login passwords, credit card details, and personal form submissions.
User Trust: Displays the secure padlock icon in the browser address bar instead of an alarming "Not Secure" warning.
SEO Ranking Boost: Google uses HTTPS as an official search ranking signal.
Required for Modern Web APIs: Features like geolocation, HTTP/2 performance, and web push notifications require HTTPS.
Step 1: Obtain an SSL Certificate
Before configuring WordPress, you need an active SSL certificate installed on your web server:
Free SSL (Let's Encrypt): Most modern web hosts (cPanel, Hostinger, SiteGround, Bluehost, DigitalOcean) offer free 1-click Let's Encrypt SSL certificates.
Cloudflare Flexible/Full SSL: You can route your traffic through Cloudflare's free CDN tier for free SSL protection.
Paid SSL Certificates: Ideal for e-commerce sites needing wildcard coverage or organizational validation (OV/EV).
Tip: Check with your hosting provider’s control panel (cPanel, Plesk, or hosting dashboard) under "SSL/TLS Status" to ensure your domain has an active certificate.
Step 2: Update Your WordPress Address URLs
Once your SSL certificate is active on your server, tell WordPress to use https://:
Log into your WordPress admin dashboard.
Navigate to Settings → General.
Locate WordPress Address (URL) and Site Address (URL).
Change both URLs from http:// to https://.
Example: http://example.com → https://example.com
Scroll to the bottom and click Save Changes.
Note: You may be automatically logged out after saving. Simply log back in using your regular username and password.
Step 3: Set Up a 301 Redirect (HTTP to HTTPS)
To ensure visitors typing http://example.com automatically land on https://example.com, add a 301 permanent redirect to your site's .htaccess file (for Apache web servers):
Open your .htaccess file using FTP or your hosting File Manager.
Add the following code at the very top:
<IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] </IfModule>
If your server runs on Nginx, add this rule to your server configuration file:
server { listen 80; server_name example.com www.example.com; return 301 https://example.com$request_uri; }
Step 4: Fix Mixed Content Warnings
If your browser still shows a yellow warning icon instead of a green padlock, your site has mixed content (loading images, scripts, or stylesheets over unencrypted HTTP).
Quick Fixes for Mixed Content:
Search & Replace Plugin: Use a plugin like Better Search Replace to update all instances of http://yourdomain.com/wp-content/ to https://yourdomain.com/wp-content/ in your database.
Update Theme/CSS Files: Ensure hardcoded font links (e.g. Google Fonts) or external scripts use https://.
Step 5: Verify Your Site Security Status
After updating your URLs and redirects, test your site’s security health:
Open an Incognito window and visit your website URL.
Verify that the padlock icon appears next to your web address.
Use our free SecureShield WordPress Plugin dashboard to run a quick 1-click audit. SecureShield automatically checks your SSL status, login protection, and 2FA configuration to keep your website safe.
Need Expert Assistance?
If you run into issues like redirect loops (ERR_TOO_MANY_REDIRECTS) or mixed content errors on complex WordPress sites, HireCode Pro is here to help!
Our expert WordPress developers can handle your full site security audit, SSL installation, and performance optimization.
No comments yet
Be the first to share your thoughts on this article!