Activating SSL in WordPress

WordPress can use HTTPS after a valid SSL/TLS certificate is installed for the website hostname. The certificate must work at the hosting server or correctly configured proxy before WordPress addresses are changed.

Before changing WordPress

Confirm that https:// opens the website without a certificate warning.
Check that the certificate covers the root, www and any other required hostnames.
Create a current file and database backup.
Review any CDN or reverse-proxy SSL settings.

Move WordPress to HTTPS

Update the WordPress Address and Site Address to the intended https:// URLs.
Add one redirect from HTTP to the matching HTTPS address at the appropriate server or proxy layer.
Use a WordPress-aware replacement for old HTTP URLs stored in content and settings where required.
Clear relevant caches, then test the public website and WordPress admin.

Check for mixed content and redirect loops

Open pages with images, scripts, forms, login and checkout features. A mixed-content warning means part of the HTTPS page still requests an insecure resource. Repeated redirects usually mean WordPress, the host and a proxy disagree about the preferred URL or connection state.

See SSL Certificates for certificate background and Redirect Configuration for choosing the redirect layer.

Common questions

Frequently Asked Questions

Can I change WordPress to HTTPS before installing the certificate?

No. Make sure the certificate works for the hostname first, or visitors and administrators may receive security warnings or lose access.

What is mixed content?

It occurs when an HTTPS page still loads an image, script, stylesheet or other resource over HTTP. Update the resource to a secure URL.

Why does enabling HTTPS cause too many redirects?

WordPress, the host, CDN or reverse proxy may be applying conflicting HTTPS rules or reporting the original connection incorrectly.

Will the SSL certificate renew automatically?

That depends on the host or certificate provider. Confirm its renewal method and make sure domain validation and DNS remain available.