How to move WordPress from HTTP to HTTPS?

To move WordPress from HTTP to HTTPS, first install an SSL certificate on your hosting account (most hosts offer free Let's Encrypt certificates). Then change both URLs in Settings > General to start with https://, replace old http:// links in your database with a search-replace tool, and add a 301 redirect so every HTTP request goes to the HTTPS version. Finally, fix any mixed content warnings, update Google Search Console, and test your site.

HTTPS encrypts the connection between your visitors and your server, protects login details and form submissions, and removes the "Not Secure" warning that browsers show on HTTP pages. This guide walks through the full migration step by step, with both a plugin-based route for beginners and a manual route for anyone who wants clean, plugin-free control. You'll also learn how to diagnose mixed content and avoid redirect loops.

Why Move WordPress to HTTPS?

There are several strong reasons to make the switch:

• Security: HTTPS encrypts data in transit, so passwords, form entries, and cookies can't be read or modified by anyone intercepting the connection.
• Browser trust: Chrome, Firefox, Safari, and Edge flag HTTP pages as "Not Secure," which can scare visitors away, especially on pages with forms.
• SEO: Google has used HTTPS as a ranking signal since 2014. It's a small factor, but there's no reason to miss out.
• Modern features: Many browser features, including HTTP/2 and HTTP/3 performance benefits in practice, service workers, geolocation, and some payment APIs, require a secure connection.
• Requirements: Payment processors and many third-party services expect HTTPS.

Before You Start

1. Back up your site: Take a full backup of your files and database. The migration touches URLs throughout your database, so you'll want a way back.

2. Check your hosting options: Look in your control panel for an SSL, SSL/TLS, or Security section. Most hosts include free SSL certificates.

3. Note your current URLs: Check Settings > General to see exactly what your WordPress Address and Site Address are, including whether they use www.

4. Plan a quiet time: Migrating during low-traffic hours limits the impact if something goes wrong.

Step 1: Install an SSL Certificate

An SSL/TLS certificate proves your domain's identity and enables encryption. You have a few options:

• Free certificates from your host: Most hosts provide free Let's Encrypt certificates, often with automatic renewal. In cPanel, look for SSL/TLS Status or AutoSSL. Managed WordPress hosts typically have a one-click SSL toggle.
• Cloudflare: If your DNS runs through Cloudflare, it can provide HTTPS at its edge. You should still install a certificate on your server (a free Cloudflare Origin Certificate or Let's Encrypt) and use Full (strict) SSL mode.
• Paid certificates: Organization Validated (OV) and Extended Validation (EV) certificates are available from certificate authorities, but for most sites a free Domain Validated certificate provides the same encryption.

If you manage your own server, you can issue a Let's Encrypt certificate with Certbot. For Nginx:

sudo certbot --nginx -d example.com -d www.example.com

For Apache:

sudo certbot --apache -d example.com -d www.example.com

Certbot configures automatic renewal. You can test it with sudo certbot renew --dry-run.

Make sure the certificate covers both example.com and www.example.com. Then visit https://example.com in your browser. Your site might look broken or show warnings at this stage, but if the browser accepts the certificate, you're ready to continue.

Step 2: Update Your WordPress URLs

1. Open General Settings: Go to Settings > General.

2. Update both addresses: Change WordPress Address (URL) and Site Address (URL) from http:// to https://. Keep everything else, including www or not, exactly the same.

3. Save your changes: Click Save Changes. WordPress will log you out.

4. Log in again: Sign in at https://example.com/wp-admin.

If those fields are grayed out, the URLs are defined in wp-config.php. Open the file and update them there:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

You can also use WP-CLI:

wp option update home 'https://example.com'
wp option update siteurl 'https://example.com'

Step 3: Replace HTTP URLs in Your Database

Changing the site URLs doesn't update links already stored in your content. Images, internal links, widget content, and plugin settings may still reference http://. These cause mixed content, where a secure page loads insecure resources.

Don't use a plain SQL REPLACE() query for this. WordPress and many plugins store serialized data, which records string lengths; changing the length of a URL with a simple query can corrupt that data. Use a tool that understands serialization.

Using WP-CLI

Run a dry run first to see what will change:

wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run

If the report looks right, run it for real:

wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid

If your site uses www, run it for that version too, such as http://www.example.com. Skipping the guid column is recommended, because GUIDs are meant to be permanent identifiers for feed readers, not links.

Using a Plugin

If you don't have WP-CLI, install Better Search Replace:

1. Install and activate it: Go to Plugins > Add New Plugin, search for "Better Search Replace," and activate it.

2. Open the tool: Go to Tools > Better Search Replace.

3. Enter the URLs: Put http://example.com in Search for and https://example.com in Replace with.

4. Select tables: Select all tables.

5. Do a dry run: Leave Run as dry run? checked and click Run Search/Replace to see how many changes will be made.

6. Run it for real: Uncheck the dry run option and run it again.

Step 4: Redirect HTTP to HTTPS

Now make sure anyone who visits the old HTTP address is sent to HTTPS with a permanent 301 redirect. This protects visitors using old bookmarks and passes your search rankings to the new URLs.

Many hosts provide a Force HTTPS toggle that does this at the server level. If yours does, use it. Otherwise, add rules yourself.

Apache (.htaccess)

Add this at the very top of the .htaccess file in your WordPress root, above the # BEGIN WordPress block:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

The X-Forwarded-Proto condition prevents redirect loops on hosts that terminate SSL at a load balancer or proxy.

Nginx

Add a server block that listens on port 80 and redirects everything:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Your existing HTTPS server block handles requests on port 443. Test and reload Nginx:

sudo nginx -t && sudo systemctl reload nginx

Using a Plugin Instead

If you can't edit server files, Really Simple SSL can handle redirects, detect your certificate, and fix common mixed content issues automatically. It's a reasonable option for beginners, though server-level redirects are faster and don't depend on a plugin staying active.

Step 5: Force SSL for the Admin Area

WordPress includes a constant that forces the dashboard and login pages to use HTTPS. Add this to wp-config.php above /* That's all, stop editing! */:

define( 'FORCE_SSL_ADMIN', true );

If your site sits behind a reverse proxy or load balancer, such as some Cloudflare or cloud hosting setups, WordPress might not realize the connection is secure, causing a redirect loop. In that case, add this above the FORCE_SSL_ADMIN line:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
    $_SERVER['HTTPS'] = 'on';
}

Only use this snippet when your server is actually behind a trusted proxy that sets this header.

Step 6: Fix Mixed Content Warnings

Mixed content happens when an HTTPS page loads a resource, like an image, script, stylesheet, or iframe, over HTTP. Browsers may block insecure scripts entirely and show a warning instead of the padlock.

How to Find Mixed Content

1. Use browser developer tools: Open your site, press F12 (or Cmd + Option + I on macOS), and check the Console tab. Mixed content warnings list the exact URL of each insecure resource.

2. Check the Security panel: In Chrome, the Security tab in developer tools summarizes whether the page is fully secure.

3. Scan your site: Online tools like Why No Padlock can scan a page and list insecure resources.

Common Sources and Fixes

• Content links: Run the search-replace again for any variations you missed, like http://www.example.com.
• Theme files: Look for hardcoded http:// URLs in your theme. Use WordPress functions such as get_template_directory_uri() or home_url(), which automatically use the correct protocol.
• Page builders: Some builders store CSS in separate files. Regenerate them from the builder's settings, for example Elementor's Regenerate CSS & Data tool.
• Customizer and widgets: Check logos, background images, and Custom HTML widgets.
• Third-party embeds: Update old embed codes to use https:// URLs. If a service doesn't support HTTPS, replace it.
• Caching: Clear your caching plugin, server cache, and CDN after making fixes.

As an extra safety net, you can ask browsers to automatically upgrade any remaining insecure requests with a Content Security Policy header. Add this to .htaccess on Apache:

<IfModule mod_headers.c>
Header always set Content-Security-Policy "upgrade-insecure-requests"
</IfModule>

Or in your Nginx HTTPS server block:

add_header Content-Security-Policy "upgrade-insecure-requests" always;

This header tells the browser to request HTTP resources over HTTPS instead. It's a helpful backstop, but you should still fix the underlying URLs.

Step 7: Consider HSTS

HTTP Strict Transport Security (HSTS) tells browsers to only ever connect to your site over HTTPS, even if someone types http://. It improves security, but once a browser has seen the header, it will refuse HTTP connections to your domain until the header expires. Only enable it after you've confirmed HTTPS works everywhere, and start with a short max-age.

On Apache:

<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=300"
</IfModule>

On Nginx:

add_header Strict-Transport-Security "max-age=300" always;

Once you're confident, increase max-age to a long value such as 31536000 (one year). Only add includeSubDomains if every subdomain supports HTTPS.

Step 8: Update External Services

Your site is secure, but a few services still need to know about the change:

• Google Search Console: Add the HTTPS version as a property if you use a URL-prefix property, or use a Domain property that covers all protocols. Submit your sitemap at the HTTPS URL.
• Google Analytics: Update the stream or default URL to https://.
• Social profiles and listings: Update links on social media, Google Business Profile, and directories.
• CDN settings: If you use a CDN, make sure it serves your site over HTTPS and that its origin settings use HTTPS.
• Email and ads: Update links in email templates, newsletter footers, and ad campaigns.

Step 9: Test Everything

Walk through your site carefully:

1. Visit key pages over HTTP: Confirm they redirect to HTTPS with a single 301 redirect. You can check with curl -I http://example.com.

2. Check the padlock: Make sure the browser shows a secure connection on the homepage, posts, and pages.

3. Test forms and checkout: Submit contact forms, test login, and run through any checkout or membership flows.

4. Check the admin area: Confirm the dashboard loads over HTTPS without warnings.

5. Test your certificate: Tools like SSL Labs' SSL Server Test grade your certificate and server configuration.

Troubleshooting HTTPS Migration Issues

Too many redirects: Usually caused by conflicting redirects, such as a plugin redirect plus a server redirect, or Cloudflare's SSL mode set to Flexible while your server also forces HTTPS. Use one redirect method and set Cloudflare to Full (strict).

Locked out of the dashboard: Fix the URLs by adding WP_HOME and WP_SITEURL to wp-config.php, or with WP-CLI, then remove any conflicting redirect rules.

Certificate warnings: The certificate may not cover www, or it may have expired. Reissue it to cover both versions and make sure automatic renewal is enabled.

Missing padlock on some pages: Those pages load mixed content. Use the browser console to find the insecure resource and fix its URL.

Old URLs still appear: Clear all caches and check for hardcoded URLs in theme files, page builder data, or plugin settings.

---

FAQ: Moving WordPress from HTTP to HTTPS

---

Conclusion

Moving WordPress from HTTP to HTTPS is one of the most valuable upgrades you can make to your site. Install an SSL certificate, update your WordPress URLs, replace old links with a serialization-safe search-replace, and add a permanent redirect so every visitor ends up on the secure version of your site.

Once the basics are done, clean up any mixed content, consider enabling HSTS carefully, and update Google Search Console and your other services. Your visitors will see the padlock, your login and form data will be protected, and your site will be ready for everything the modern web expects.