What this problem looks like
Forcing HTTPS happens at three layers: the certificate on the host, WordPress URL settings, and a 301 redirect that upgrades http requests before PHP runs. Missing any layer causes mixed content or redirect loops.
Apache hosts usually rely on .htaccess. Nginx and managed WordPress need host panel redirect rules instead of pasted Apache snippets.
Step 1: Confirm SSL works on the host
Before forcing redirects, open https://yourdomain.com directly. If the certificate is invalid, fix that first. Let's Encrypt auto-renewal should be enabled in cPanel or your host SSL panel.
Step 2: Set WordPress to HTTPS
Settings → General → set both WordPress Address and Site Address to https://. If admin is unreachable, open wp-config.php in your site root, next to wp-admin and wp-content, and define WP_HOME and WP_SITEURL:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Step 3: Force HTTPS in .htaccess (Apache)
Find .htaccess in your site root, next to wp-admin and wp-content. Add this above the WordPress rewrite block. Back up .htaccess first via File Manager, SFTP, or FTP.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>Step 4: Configure nginx or host redirects
On nginx, ask your host to add a return 301 https://$host$request_uri; rule. Managed WordPress hosts often provide a one-click Force HTTPS toggle that is safer than manual edits.
Step 5: Test wp-login, cookies, and checkout
Log out, clear cookies, and log in again over https. WooCommerce checkout must submit without browser warnings. If login loops, see our login redirect loop tutorial and verify siteurl matches how you access admin.
When to stop DIY and hire help
Redirect loops between Cloudflare, nginx, and WordPress are a common emergency call. BugShield aligns HTTPS end to end at a confirmed fixed price without trial-and-error on live shops.