To enable SSL in WordPress using a plugin, install Really Simple SSL from the official repository, activate it, and click "Activate SSL" — the plugin detects your certificate and automatically redirects all traffic to HTTPS.
If your hosting already has an SSL certificate installed but your WordPress site still serves HTTP pages, Really Simple SSL is the fastest and safest way to complete the migration. Here is every step you need to take.
Before You Start: SSL Certificate Must Already Be Active
Really Simple SSL enables HTTPS inside WordPress — it does not install a certificate on your server. Confirm you have a valid SSL certificate first:
- Log in to your hosting control panel (cPanel, Plesk, or DirectAdmin) and verify SSL is enabled for your domain.
- If your host includes free Let's Encrypt certificates, activate one from the panel before proceeding.
- Type
https://yourdomain.comin your browser — if you see a padlock, the certificate is already live.
No certificate yet? Check the SSL certificate guide to choose and install the right one for your site.
Step 1: Install and Activate the Plugin
Log in to your WordPress admin panel (yourdomain.com/wp-admin) and follow these steps:
- Go to Plugins → Add New.
- Search for Really Simple SSL (author: Really Simple Plugins).
- Click Install Now, then Activate.
The plugin has over 6 million active installations and is updated regularly — it is the most reliable option for this task.
Step 2: Enable SSL With One Click
After activation, WordPress displays a notice at the top of the dashboard:
"We detected an SSL certificate! To activate HTTPS, click the button below."
- Click the "Activate SSL" button.
- WordPress will log you out automatically and redirect you back in over HTTPS.
- Once logged back in, you will see a confirmation that SSL is active.
The plugin makes three changes automatically:
- Updates the site URLs in
Settings → Generalfromhttp://tohttps://. - Adds a 301 redirect from HTTP to HTTPS.
- Enables the HSTS header to tell browsers always to use HTTPS.
Step 3: Check and Fix Mixed Content Errors
Mixed content errors occur when the page loads over HTTPS but some resources — images, scripts, or stylesheets — still point to HTTP URLs.
Really Simple SSL includes a basic mixed-content fix that works via an output buffer. For most sites this is enough. If browser warnings persist:
- Go to Settings → SSL and enable "Fix mixed content" if it is not already checked.
- Use professional SSL auditing or a free tool like Why No Padlock to pinpoint specific resources still loading over HTTP.
- Update hard-coded HTTP URLs in the database using the Better Search Replace plugin.
Free vs. Pro: Which Version Do You Need?
| Feature | Free | Pro |
|---|---|---|
| HTTP → HTTPS redirect | ✓ | ✓ |
| Mixed content fix | Basic | Advanced |
| HTTP security headers | HSTS only | CSP, X-Frame, etc. |
| Vulnerability scanner | ✗ | ✓ |
| Priority support | ✗ | ✓ |
For most blogs, business sites, and small stores, the free version is all you need.
Key Takeaways
- Really Simple SSL requires an SSL certificate already installed on the server — the plugin only activates HTTPS inside WordPress.
- Activation takes one click and completes in under two minutes.
- The plugin automatically handles the 301 redirect and the HSTS header.
- Persistent mixed-content warnings can be fixed by finding HTTP URLs with external tools or using Better Search Replace.
- The free version covers most sites; the Pro tier adds advanced security headers.
Ready to take your site's security further? The team at elenlace.com can audit your HTTP headers, verify your certificate chain, and harden your WordPress installation from top to bottom.
FAQ
Does Really Simple SSL install the SSL certificate for me?
No. The plugin assumes a certificate is already active on your server. Its job is to configure WordPress to use HTTPS: it updates site URLs, sets up the redirect, and enables HSTS. If you need to install a certificate first, do that through your hosting control panel.
Is Really Simple SSL safe to use on a production site?
Yes. With over 6 million active installs and regular security audits, it is one of the most trusted plugins in the official WordPress repository. Keep it updated to stay protected.
What do I do if I get a redirect loop after enabling the plugin?
This usually happens when your hosting uses a reverse proxy (such as Cloudflare) and PHP cannot correctly detect HTTPS. Go to Settings → SSL → HTTPS Detection and enable "Detect HTTPS behind a proxy." If the issue continues, contact your hosting provider.
Do I need to deactivate the plugin when I renew or change my certificate?
No. As long as the new certificate is installed on the server before the old one expires, Really Simple SSL keeps working without interruption. The plugin is not tied to a specific certificate type or provider.
Further reading
Other providers and guides worth comparing:
