Types of SSL problems on WordPress
- Expired or missing certificate on the server
- Certificate issued for www but visitors use apex, or the reverse
- Cloudflare or CDN SSL mode mismatch with origin host
- WordPress siteurl/home still set to http://
- Mixed content: images, CSS, or scripts loaded over http on an https page
Step 1: Verify the certificate at the host
Log into hosting and open SSL/TLS or Let’s Encrypt. Confirm a valid certificate exists for every hostname you use publicly. Test both https://example.com and https://www.example.com in a private browser window.
Step 2: Set WordPress to HTTPS
In wp-admin go to Settings → General. Set both WordPress Address and Site Address to https://. If admin will not load, set URLs in wp-config.php instead:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Replace example.com with your live domain. Use the canonical hostname you want in Google Search Console, usually apex or www, not both without redirects.
Step 3: Force HTTPS in .htaccess (Apache)
On Apache hosts, add this above the WordPress rewrite block in .htaccess in the site root. Back up the file first.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>Nginx users need a server block change from the host or a managed redirect rule. Do not paste Apache rules into nginx.
Step 4: Fix mixed content
Open browser DevTools → Console on an https page. Mixed content warnings list http URLs for images, scripts, or CSS. Common fixes:
- Run a search-replace on the database from http to https for your domain only, with a backup first.
- Re-save permalinks under Settings → Permalinks.
- Clear page cache and CDN cache after URL changes.
- Update hardcoded http links in widgets, page builders, or theme customiser fields.
Use WP-CLI search-replace on staging when possible:
wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run
wp search-replace 'http://example.com' 'https://example.com' --all-tablesStep 5: Test login and checkout
After SSL changes, log out and log in again. WooCommerce checkout and contact forms should submit over https without browser warnings. Cookie issues often mean WordPress URL and redirect rules disagree.