How to Enable HTTPS on WordPress Step by Step

To enable HTTPS on WordPress you need three things: an SSL certificate installed on your server, the site URL updated to https:// inside WordPress, and a 301 redirect that sends all HTTP traffic to the new HTTPS URL. Without all three steps, your site will either keep showing warnings or break entirely.

This guide walks you through each step in order, including how to fix mixed content and how to verify everything is working correctly.

Step 1: Verify the SSL Certificate Is Installed

Before touching WordPress, confirm the SSL certificate is already active on your hosting. Open your browser and type https://yourdomain.com directly.

• Closed padlock → the SSL is installed. Move on to step 2.
• Privacy warning or blank page → the SSL is not installed or is misconfigured. Install it first.

On shared hosting with cPanel, activate Let's Encrypt under Security → SSL/TLS Status → AutoSSL. On a VPS, install Certbot with the Apache or Nginx plugin. For more details on SSL certificates and web security, browse our SSL security article library.

Step 2: Update the Site URL in WordPress

WordPress stores the base URL in the database. You must update it from http:// to https://.

Option A — From the Admin Dashboard (easiest)

Go to Settings → General. Change both WordPress Address (URL) and Site Address (URL) from http://yourdomain.com to https://yourdomain.com. Click Save Changes.

WordPress will log you out and ask you to log back in at the HTTPS URL. This is expected.

Option B — From wp-config.php (if the dashboard won't load)

Edit the wp-config.php file in the root of your WordPress installation and add these two lines before the /* That's all, stop editing! */ comment:

define('WP_HOME', 'https://yourdomain.com');
define('WP_SITEURL', 'https://yourdomain.com');

Save the file. These constants override the database values — useful when you can't access the admin panel.

Step 3: Force the HTTP → HTTPS Redirect

Changing the URL in WordPress does not automatically redirect visitors who land on the http:// version. You need a server-level redirect rule.

On Apache (.htaccess file)

Open the .htaccess file in your site root (it's hidden; enable "show hidden files" in the cPanel file manager). Add these lines at the very top, before the # BEGIN WordPress block:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Nginx

Add a separate server block for port 80 that redirects to HTTPS:

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

Reload Nginx with sudo systemctl reload nginx.

Using a WordPress Plugin

If you don't have server access, the Really Simple SSL plugin handles it automatically. Once activated, it detects the certificate, updates the URLs, and adds the redirect — the fastest solution for non-technical users.

Step 4: Detect and Fix Mixed Content

Mixed content occurs when your page loads over HTTPS but some resource (image, script, stylesheet, iframe) is still called from a http:// URL. Browsers block or flag these resources, causing the padlock to disappear or show a warning.

How to Detect It

Open browser DevTools with F12, go to the Console tab, and look for messages like:

Mixed Content: The page at 'https://...' was loaded over HTTPS, but requested an insecure resource 'http://...'

How to Fix It

Option 1 — Better Search Replace plugin (recommended for most cases):

1. Install and activate Better Search Replace.
2. Go to Tools → Better Search Replace.
3. In "Search for" enter http://yourdomain.com; in "Replace with" enter https://yourdomain.com.
4. Select all database tables.
5. Click Run Search/Replace.

Option 2 — WP-CLI (for developers):

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables

Option 3 — External resources: if mixed content comes from a plugin or theme calling external resources over HTTP (fonts, CDN, APIs), update those URLs in the plugin's settings or contact the developer.

Step 5: Verify Everything Works

After completing the steps above, run these checks:

If you'd rather have experts handle the migration, the team at elenlace.com can enable HTTPS on your WordPress site and fix all mixed content issues without any downtime.

Common Errors and How to Fix Them

Infinite redirect loop

This happens when WordPress keeps redirecting to itself. Most common cause: the URLs in Settings → General are still set to http:// even though .htaccess is already redirecting. Fix: make sure both URLs in Settings are updated to https://.

White Screen of Death after enabling HTTPS

A plugin or theme likely has a hardcoded URL. Deactivate plugins one by one to find the culprit. Alternatively, use WP-CLI to run the search-replace before activating the redirect.

Padlock shows a warning (yellow or exclamation mark)

There's mixed content. Follow Step 4 to detect and fix it. The warning disappears once all resources load over HTTPS.

Admin panel won't load over HTTPS

Check that wp-config.php doesn't have old WP_HOME or WP_SITEURL definitions pointing to http://. If it does, update them to https://.

Key Takeaways

• Enabling HTTPS on WordPress requires three steps in order: install the SSL, update the URLs in WordPress, and force the 301 redirect.
• Update both WordPress Address and Site Address to https:// in Settings → General.
• The HTTP → HTTPS redirect goes in .htaccess (Apache) or a server block (Nginx), before the WordPress block.
• Mixed content is the most common issue after enabling HTTPS; Better Search Replace fixes it in seconds.
• Use SSL Labs to verify the certificate is properly installed and no warnings remain.
• Really Simple SSL is the fastest option if you don't have SSH access to the server.

Having trouble enabling HTTPS on your WordPress site? The team at elenlace.com handles HTTP-to-HTTPS migrations with zero downtime — including mixed content fixes and full SSL verification.

FAQ

Does enabling HTTPS on WordPress affect SEO?

Yes, but positively. Google has used HTTPS as a ranking signal since 2014. The migration may cause a slight initial fluctuation while Google re-crawls your site, but medium-term it improves or maintains your rankings. Implement the 301 redirect correctly to pass SEO authority from your old HTTP URLs.

Do I need to update my sitemap after enabling HTTPS?

Yes. Your sitemap must point to https:// URLs. If you use Yoast SEO, RankMath, or any SEO plugin, regenerate the sitemap after the change. Then update the sitemap URL in Google Search Console and resubmit it.

What about external links (backlinks) pointing to my HTTP URL?

The 301 redirect you configured automatically passes "link juice" (SEO authority) from HTTP to HTTPS URLs. You don't need to contact every site that links to you — the redirect handles it transparently.

Is Really Simple SSL enough, or do I need to configure .htaccess manually?

For most installations on shared hosting, Really Simple SSL is sufficient: it detects the SSL, updates the URLs, and adds the redirect. However, for complex setups (multisite, custom .htaccess rules) or Nginx servers, manual server-level configuration is more reliable and robust.

Further reading

Other providers and guides worth comparing:

• GoDaddy
• HostGator México
• Hostinger