Installing an SSL certificate is only half the job. If WordPress is not switched over properly you get “Not secure” warnings, mixed content errors, or two copies of your site in Google. Here is why SSL matters and how to set it up correctly.
Why every site needs SSL
- Browsers warn visitors on any page that is not served over HTTPS, especially ones with forms.
- Data in transit is encrypted, including logins and form submissions.
- Google uses HTTPS as a ranking signal and shows HTTPS pages first when all else is equal.
- Modern features require it, including Stripe payments, many browser APIs and HTTP/2 or HTTP/3 speed improvements.
Get a certificate (it should be free)
Nearly every good host provides free certificates from Let’s Encrypt that renew automatically. Look for “SSL” in your hosting panel and enable it for each domain, including the www version. Paid certificates are only needed for specific business or compliance requirements.
Switch WordPress to HTTPS in five steps
- Back up the site.
- Update the site URLs. In Settings → General, change both the WordPress Address and the Site Address to start with
https://. - Update links in your content. Run a search and replace of
http://yourdomain.comtohttps://yourdomain.comacross the database, using WP-CLI (wp search-replace) or a plugin like Better Search Replace. This fixes images and internal links that would otherwise trigger mixed content warnings. - Force HTTPS with a redirect. Most hosts have a “Force HTTPS” toggle. Otherwise add a 301 redirect at the server level so every
http://request goes tohttps://. - Tell Google. Add the HTTPS version as a property in Google Search Console (a Domain property covers both) and resubmit your sitemap.
Check for mixed content
Visit key pages and look for the padlock. If the browser shows a warning, open developer tools and check the Console for “Mixed Content” messages naming the file loading over HTTP. Hard-coded URLs in theme files, page builder CSS or widgets are the usual cause. See our guide to fixing mixed content.
Using a CDN like Cloudflare?
Set the SSL mode to Full (strict), which requires a valid certificate on your server too. “Flexible” mode often causes redirect loops with WordPress.
Addon domains and subdomains
Each domain and subdomain needs to be covered by a certificate. If you are on cPanel, see adding SSL to an addon domain.
Rather we handle it?
Our $79 one-time fix covers an HTTPS switch or a mixed content cleanup. Sites on our managed hosting get SSL set up and renewed automatically.