How to Enable HTTPS on WordPress: Mixed Content Fix, HSTS Headers & Really Simple SSL Guide (2026)

Switching from HTTP to HTTPS is mandatory in 2026. HTTPS encrypts data between your visitor's browser and your server, protects user privacy, and is a ranking factor in Google Search. Chrome marks HTTP sites as "Not Secure" — a trust killer.

Why HTTPS Matters

• Security: Encrypts login credentials, form submissions, and payment data
• Trust: Green padlock (or no warning) vs "Not Secure" warning
• SEO: Google has used HTTPS as a ranking signal since 2014
• Speed: HTTP/2 (faster protocol) is only available over HTTPS
• Browser requirements: Many modern browser features require HTTPS

Step 1: Install SSL Certificate

Most hosts provide free SSL via Let's Encrypt. Check your specific host:

Hostinger:

1. Log in to hPanel → Websites → Manage
2. Go to Security → SSL
3. Under Install SSL Certificate, click Install next to your domain
4. Wait 5–10 minutes for installation

Bluehost/HostGator (cPanel):

1. Log in to cPanel → Security → SSL/TLS
2. Click Manage SSL Sites
3. Click AutoSSL or install Let's Encrypt from the interface

Cloudways:

1. Application Management → SSL Certificate
2. Choose Let's Encrypt
3. Enter your domain(s) and click Install Certificate

SiteGround:

1. Site Tools → Security → SSL Manager
2. SSL is auto-installed — if not, click the Let's Encrypt option

WP Engine / Kinsta: SSL is provisioned automatically when you add a domain. No manual setup needed.

If your host doesn't include free SSL: Use Cloudflare's free plan — it provides SSL at the CDN level, meaning your site has HTTPS even without a certificate at the origin (use "Flexible" mode only as temporary solution).

Step 2: Update WordPress URLs to HTTPS

After SSL is installed, update WordPress's URL settings.

Method A — WordPress Settings (easiest):

1. Log in to WordPress admin at http://yourdomain.com/wp-admin
2. Go to Settings → General
3. Change WordPress Address (URL) from http:// to https://
4. Change Site Address (URL) from http:// to https://
5. Click Save Changes
6. WordPress will log you out — log back in at https://yourdomain.com/wp-admin

Method B — wp-config.php (if you can't access admin): Add to wp-config.php before /* That's all, stop editing! */:

define( 'WP_HOME', 'https://yourdomain.com' );
define( 'WP_SITEURL', 'https://yourdomain.com' );

Step 3: Force HTTPS Redirects

Ensure all HTTP traffic automatically redirects to HTTPS.

Method A — .htaccess (Apache servers): Add this at the top of your .htaccess file (above WordPress rules):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Method B — Nginx config (for Nginx servers like Cloudways): Ask your host to add this to the Nginx configuration (usually managed by your host):

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://yourdomain.com$request_uri;
}

On Cloudways, this is done via Application Settings → SSL Certificate → Force HTTPS Redirection toggle.

Method C — Cloudflare: In Cloudflare dashboard → SSL/TLS → Edge Certificates → Toggle Always Use HTTPS ON.

Method D — Really Simple SSL Plugin:

1. Install Really Simple SSL plugin
2. Activate — it automatically detects your SSL and updates .htaccess
3. Click Go ahead, activate SSL!

This is the easiest one-click solution for beginners.

Step 4: Fix Mixed Content Warnings

After switching to HTTPS, some page elements may still load over HTTP (images, scripts, CSS from old URLs). This causes a "mixed content" warning — the padlock shows a warning symbol.

Identify mixed content:

1. Open Chrome DevTools (F12) → Console tab
2. Look for errors like: Mixed Content: The page at 'https://...' was loaded over HTTPS, but requested an insecure resource 'http://...'

Fix Method 1 — Really Simple SSL (automatic): The Really Simple SSL plugin automatically rewrites HTTP to HTTPS in WordPress output. Install it and most mixed content issues resolve without manual work.

Fix Method 2 — Better Search Replace (database):

1. Install Better Search Replace plugin
2. In the Search field, enter http://yourdomain.com
3. In the Replace field, enter https://yourdomain.com
4. Select all tables
5. Uncheck Run as dry run? and click Run Search/Replace

This updates all stored URLs in your database from HTTP to HTTPS.

Fix Method 3 — Manual hardcoded links: Some theme files may have hardcoded http:// URLs. Use the Search and Replace tool to find them in your codebase, or use a child theme to override the specific template.

Step 5: Update wp-config.php Security Keys

After migrating to HTTPS, regenerate your WordPress security keys. This logs out all users and forces re-authentication over HTTPS:

1. Visit api.wordpress.org/secret-key/1.1/salt/
2. Copy the generated keys
3. Replace the existing key definitions in wp-config.php

Step 6: Verify HTTPS is Working

Check SSL certificate:

1. Visit your site — look for the padlock icon in the browser address bar
2. Click the padlock → Certificate to verify it's valid and for your domain
3. Check expiry date (Let's Encrypt certificates expire every 90 days — auto-renewal should handle this)

Check redirects:

1. Type http://yourdomain.com in your browser
2. It should automatically redirect to https://yourdomain.com (permanent 301 redirect)

Check mixed content:

1. Open Chrome DevTools → Console
2. No mixed content warnings should appear on any page

Check SSL certificate quality: Visit SSL Labs SSL Test and enter your domain. You should score A or A+.

Update Google Search Console

After switching to HTTPS:

1. Add https://yourdomain.com as a new property in Google Search Console
2. Submit your HTTPS sitemap
3. Request re-indexing of your homepage

Google will eventually discover the redirects, but submitting directly to Search Console speeds up re-indexing of your HTTPS pages.

Common HTTPS Migration Issues

Site shows security warning after SSL install: Check that your SSL certificate covers both yourdomain.com and www.yourdomain.com. Let's Encrypt allows both — ensure both variants are included in the certificate.

Infinite redirect loop: Usually caused by Cloudflare Flexible SSL mode when WordPress also forces HTTPS. Set Cloudflare to Full (Strict) mode and ensure origin has a valid SSL certificate.

Admin dashboard redirecting to login repeatedly: Update WP_HOME and WP_SITEURL in wp-config.php to use https://. Clear cookies and try again.

Email links still use HTTP: Check WooCommerce email settings and other plugins that generate URLs. Update their base URL settings to use HTTPS.

---

WordPress HSTS: The Next Level of HTTPS Security

HSTS (HTTP Strict Transport Security) tells browsers to ONLY connect via HTTPS — even if someone types http:// manually. Once set, visitors can never access the HTTP version (until HSTS expires).

Add HSTS headers in .htaccess:

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

Or via PHP in WordPress (functions.php or plugin):

add_action( 'send_headers', function() {
    if ( ! headers_sent() && is_ssl() ) {
        header( 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload' );
    }
});

Really Simple SSL Pro adds HSTS headers via its security headers module — no code required.

Important: Before enabling HSTS, make sure all subdomains have valid SSL (includeSubDomains). If any subdomain lacks SSL, HSTS will break it. Test with max-age=300 (5 minutes) first, then increase to 31536000 (1 year).

WordPress-Specific SSL Issues Diagnostic Table

| Symptom | Cause | Fix | |---------|-------|-----| | Padlock shows warning | Mixed content (HTTP resources on HTTPS page) | Really Simple SSL + Better Search Replace | | Infinite redirect loop | Cloudflare Flexible SSL + WordPress forcing HTTPS | Set Cloudflare to Full (Strict) mode | | Admin redirects to login repeatedly | WP_HOME/WP_SITEURL mismatch | Update both in wp-config.php | | Images broken after SSL switch | Hardcoded HTTP image URLs in database | Better Search Replace for http://yourdomain.com | | SSL error on wp-login.php only | Cookie settings using wrong domain | Check COOKIE_DOMAIN in wp-config.php | | Third-party plugin loading HTTP script | Plugin has hardcoded HTTP URL | Contact plugin developer or add filter to rewrite | | SSL works but search results show HTTP | Old sitemap cached | Regenerate sitemap, resubmit to Search Console | | Let's Encrypt not auto-renewing | Cron job not running | Install WP Crontrol, check wp_cron is functional |

Really Simple SSL Plugin: Full Configuration Guide

Really Simple SSL is the most popular WordPress HTTPS plugin with 5M+ active installs. Here's the complete setup:

Free Version Setup

1. Install & activate Really Simple SSL
2. Backup your site first (REQUIRED — this is a significant change)
3. Click Go ahead, activate SSL!
4. The plugin will:
   • Update WP_HOME and WP_SITEURL
   • Add HTTPS redirect to .htaccess
   • Fix mixed content in real-time via output buffering
5. Test every page type (home, post, page, contact, WooCommerce)

Really Simple SSL Configuration Options

| Setting | Default | When to Change | |---------|---------|----------------| | Force HTTPS | On | Never off for production sites | | Mixed content fixer | On | Can turn off if it causes layout issues | | HTTP Strict Transport Security | Off | Enable once all pages test clean | | Site Health | On | Keep on — alerts to SSL issues | | Cache headers | Off | Enable for performance (adds cache-control headers) |

Known Really Simple SSL Conflicts

| Plugin | Conflict | Solution | |--------|---------|---------| | WP Rocket | Output buffer conflict | Disable mixed content fixer in Really Simple SSL (WP Rocket handles it) | | Cloudflare plugin | Duplicate redirects | Ensure only one forces HTTPS — disable in one | | Elementor | Occasionally breaks | Regenerate CSS after SSL switch in Elementor settings | | Divi Builder | Cached HTTP styles | Purge Divi static CSS after switching |

Choosing a host with automatic SSL? Hostinger, Cloudways, and Kinsta all auto-provision and auto-renew SSL certificates for every domain you add.