To enable HTTPS in WordPress from your hosting control panel, you only need three steps: install an SSL certificate through the panel, update your site URLs inside WordPress, and activate a permanent HTTP-to-HTTPS redirect. The whole process takes under ten minutes and requires no coding.
Below we walk through each step in detail so your site ends up fully secured.
Why Enable HTTPS on Your WordPress Site?
The padlock in the browser bar is more than cosmetic. HTTPS encrypts traffic between visitors and your server, protects form data and passwords, and has been a Google ranking signal since 2014.
Modern browsers like Chrome and Firefox actively label HTTP sites as "Not Secure," which erodes visitor trust and pushes up bounce rates. Enabling HTTPS is no longer optional — it is baseline hygiene.
If you want to understand which type of certificate is right for your use case, browse the full resource library in our SSL security for websites section.
Step 1 — Install the SSL Certificate from Your Hosting Panel
Most hosting providers include a free Let's Encrypt certificate. The exact steps differ slightly by control panel:
In cPanel
- Log in to cPanel and look for the Security section.
- Click SSL/TLS or Let's Encrypt™ SSL (label varies by provider).
- Select your domain and click Issue Certificate or Install.
- Wait a few seconds for the panel to confirm the installation.
In Plesk
- Go to Websites & Domains and select your domain.
- Click SSL/TLS Certificates, then Get free certificate (Let's Encrypt).
- Check the box for Secure the www subdomain as well and click Get it.
If your provider does not include Let's Encrypt, you'll need to purchase a DV certificate, download it, and upload it manually using the SSL/TLS Manager option in cPanel.
| Certificate Type | Approximate Cost | Validity | Best For |
|---|---|---|---|
| Let's Encrypt (free DV) | $0 | 90 days (auto-renews) | Blogs, portfolios, small businesses |
| Paid DV SSL | $10–$30 USD/year | 1 year | Small sites needing included support |
| OV SSL | $40–$130 USD/year | 1–2 years | Companies needing organizational validation |
| EV SSL | $150+ USD/year | 1–2 years | Banks, payment platforms |
Step 2 — Update WordPress URLs to HTTPS
With the certificate installed, WordPress still has its URLs set to http://. You need to change them to avoid mixed-content warnings.
Option A: Via the WordPress Admin Dashboard
- Go to Settings → General in your WordPress admin (
/wp-admin). - Change both WordPress Address (URL) and Site Address (URL) from
http://tohttps://. - Click Save Changes. WordPress will log you out; log back in.
Option B: With WP-CLI (if your host supports it)
wp option update siteurl 'https://yourdomain.com'
wp option update home 'https://yourdomain.com'This is sufficient for most sites. If you have images or resources hardcoded with absolute HTTP URLs, also run:
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guidStep 3 — Force HTTPS with a 301 Redirect
Even with WordPress pointing to HTTPS, someone might type http:// into their browser. A server-level 301 redirect guarantees every visitor lands on the secure version.
Recommended Method: cPanel → .htaccess Editor
Add these lines at the very top of the .htaccess file, before any WordPress block:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Save the file. Open a private browser window and confirm that http://yourdomain.com redirects automatically to https://yourdomain.com.
Alternative: Really Simple SSL Plugin
If you prefer not to edit server files, the free Really Simple SSL plugin detects the installed certificate and applies the redirect in one click. Keep in mind that relying on a plugin for something this fundamental adds an extra maintenance dependency.
Check for Mixed Content
After enabling HTTPS, some resources (images, scripts) may still load over http://, causing a padlock warning. To identify them:
- Open DevTools in Chrome (F12) → Console tab. Mixed-content errors appear in red.
- Use online tools such as Why No Padlock or SSL Checker.
- The Better Search Replace plugin can update old HTTP URLs stored in the WordPress database.
Key Takeaways
- HTTPS is essential: it improves security, SEO, and visitor trust.
- The SSL certificate installs in minutes via cPanel or Plesk; Let's Encrypt is free and auto-renews.
- Update WordPress URLs under Settings → General to prevent mixed-content issues.
- Add a 301 redirect in
.htaccessto ensure all traffic lands on HTTPS. - Verify with DevTools or external tools that no insecure resources remain.
Need hands-on help migrating your site to HTTPS without downtime? The team at elenlace.com handles the full transition safely, so you can focus on your business.
FAQ
Will enabling HTTPS delete my content or database?
No. The process only changes the communication protocol and the configuration URLs. Your content, database, and images stay intact as long as you follow the steps in order.
Is Let's Encrypt as secure as a paid SSL certificate?
For the vast majority of sites, yes. The encryption is identical (TLS 1.2/1.3). The difference is in validation level: Let's Encrypt only verifies domain control (DV), while OV and EV certificates also validate the organization behind the site.
Why do I still see a padlock warning after installing the SSL?
This is a mixed-content issue: at least one resource (image, stylesheet, or script) is still loading over http://. Use the Chrome DevTools Console to identify it, then update those URLs to https://.
Do I need to renew the certificate manually?
If you are using Let's Encrypt through cPanel or Plesk, renewal is automatic every 90 days. Paid certificates typically renew manually or with a reminder notice from the provider a few days before expiry.
Prefer it done for you? El Enlace handles hosting and professional web development.
Useful resources
Other providers and guides worth comparing:
