Learn how to fix WordPress SSL certificate errors.

What this problem looks like

• Expired or missing certificate on the server
• Certificate issued for www but visitors use apex, or the reverse
• Cloudflare or CDN SSL mode mismatch with origin host
• WordPress siteurl and home still set to http://
• Mixed content: images, CSS, or scripts loaded over http:// on an https:// page

Step 1: Verify the certificate at the host

Log into hosting and open SSL/TLS or Let’s Encrypt. Confirm a valid certificate exists for every hostname you use publicly. Test both https://example.com and https://www.example.com in a private browser window.

Step 2: Set WordPress to HTTPS

In wp-admin go to Settings → General. Set both WordPress Address and Site Address to https://. If admin will not load, set URLs in wp-config.php instead. Open wp-config.php in your site root, next to wp-admin and wp-content:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Replace example.com with your live domain. Use the canonical hostname you want in Google Search Console, usually apex or www, not both without redirects.

Step 3: Force HTTPS in .htaccess (Apache)

On Apache hosts, find .htaccess in your site root, next to wp-admin and wp-content. Back up the file first, then add this above the WordPress rewrite block:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

Nginx users need a server block change from the host or a managed redirect rule. Do not paste Apache rules into nginx.

Step 4: Fix mixed content

Open browser DevTools → Console on an https:// page. Mixed content warnings list http:// URLs for images, scripts, or CSS. Common fixes:

• Run a search-replace on the database from http:// to https:// for your domain only, with a backup first.
• Re-save permalinks under Settings → Permalinks.
• Clear page cache and CDN cache after URL changes.
• Update hardcoded http:// links in widgets, page builders, or theme customiser fields.

If your host offers SSH access, you can run WP-CLI search-replace from the WordPress root on staging. These commands need server access and will not work inside File Manager:

cd /path/to/wordpress
wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run
wp search-replace 'http://example.com' 'https://example.com' --all-tables

Step 5: Test login and checkout

After SSL changes, log out and log in again. WooCommerce checkout and contact forms should submit over https:// without browser warnings. Cookie issues often mean WordPress URL and redirect rules disagree.

When to stop DIY and hire help

If certificate renewal and URL fixes do not resolve padlock warnings, the issue may involve CDN configuration or mixed content buried in theme files. BugShield resolves SSL certificate errors at a confirmed price without hourly billing surprises.