What this problem looks like
Forcing HTTPS happens at three layers: the certificate on the host, WordPress URL settings, and a 301 redirect that upgrades http requests before PHP runs. Missing any layer causes mixed content or redirect loops.
UK hosts using Apache usually rely on .htaccess. Nginx and managed WordPress need host panel redirect rules instead of pasted Apache snippets.
Step 1: Confirm SSL works on the host
Before forcing redirects, open https://yourdomain.com directly. If the certificate is invalid, fix that first. Let us Encrypt auto-renewal should be enabled in cPanel or your host SSL panel.
Step 2: Set WordPress to HTTPS
Settings → General → set both WordPress Address and Site Address to https://. Or define WP_HOME and WP_SITEURL in wp-config.php when admin is unreachable.
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Step 3: Force HTTPS in .htaccess (Apache)
Add this above the WordPress rewrite block. Back up .htaccess first.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>Step 4: Configure nginx or host redirects
On nginx, ask your host to add a return 301 https://$host$request_uri; rule. Managed WordPress hosts often provide a one-click Force HTTPS toggle that is safer than manual edits.
Step 5: Test wp-login, cookies, and checkout
Log out, clear cookies, and log in again over https. WooCommerce checkout must submit without browser warnings. If login loops, see our login redirect loop tutorial and verify siteurl matches how you access admin.
When to stop DIY and hire help
Redirect loops between Cloudflare, nginx, and WordPress are a common emergency call. BugShield aligns HTTPS end to end at a confirmed price without trial-and-error on live shops.