SSL Certificates

An SSL/TLS certificate allows a website to use HTTPS, which encrypts information between the visitor’s browser and the service presenting the certificate. The certificate must be valid, in date and issued for the hostname being visited.

Where the certificate is installed

Hosting server: presents the certificate directly when visitors connect to the host.
CDN or reverse proxy: presents an edge certificate to visitors and should also use an encrypted, verified connection to the origin.
Managed platform: may issue and renew certificates automatically after DNS points to the service.

After enabling HTTPS

Open the root domain, the www version and any public subdomains that need HTTPS.
Confirm HTTP requests redirect once to the intended HTTPS address.
Check that images, scripts and styles also load over HTTPS without mixed-content warnings.
Test WordPress admin, forms, logins and checkout pages.
Confirm that certificate renewal is automatic or add a reminder before expiry.

WordPress and proxy settings

WordPress Home and Site URLs should use the final HTTPS address. If the site is behind Cloudflare, use Add Cloudflare to check the origin certificate and encryption mode. See Activate an SSL for WordPress-specific steps.

Common questions

Frequently Asked Questions

What is the difference between SSL and HTTPS?

The certificate supports the encrypted TLS connection, while HTTPS is the secure web protocol visitors use to access the site.

Does one certificate cover every subdomain?

Only if those hostnames are included. A wildcard certificate can cover many first-level subdomains, while another certificate may list specific names.

Why is the browser still showing a security warning?

The certificate may be expired, issued for a different hostname, missing part of its trust chain or the page may be loading insecure content. Check the exact browser message.

Does HTTPS automatically redirect HTTP visitors?

No. The certificate enables HTTPS, but the server, CDN or application still needs a redirect from HTTP to the preferred HTTPS address.