How to Install an SSL Certificate in WordPress & Enable HTTPS (2026 Guide)

If your browser shows “Not secure” next to your domain, visitors hesitate, forms lose trust and search engines notice. The fix is an SSL/TLS certificate plus a clean switch from http:// to https://. Most sites can finish it in under 30 minutes, and the certificate itself is usually free.

What SSL, TLS and HTTPS mean

SSL (Secure Sockets Layer) is the name most people still use, but the protocol actually running today is TLS (Transport Layer Security). A certificate issued by a trusted Certificate Authority (CA) proves your server owns the domain and enables an encrypted connection. When that connection is active, the address starts with HTTPS.

Why your WordPress site needs HTTPS

• Trust: browsers flag HTTP pages, especially those with login or checkout forms.
• Security: logins, form entries and orders can’t be sniffed or tampered with in transit.
• SEO: Google treats HTTPS as a lightweight ranking signal, and a correct migration protects the rankings you already have. See our on-page SEO guide for what else matters.
• Speed: browsers only use HTTP/2 and HTTP/3 over HTTPS, so a secure site is often faster.
• Payments and APIs: payment gateways, Service Workers and many browser features require a secure origin.

Before you start

1. Back up your files and database. Our guide on changing URLs in the database explains why.
2. Decide on one canonical version: https://example.com or https://www.example.com. The certificate must cover both, even if you never use one of them.
3. Check DNS: the domain must already point to your server, otherwise validation fails.
4. List extra domains (old, parked, subdomains) that should redirect to the main one.

Choose your installation method

Method	Cost	Difficulty	Best for
Host one-click SSL	Free	Easy	Shared and managed hosting
Certbot (Let’s Encrypt)	Free	Medium	VPS or cloud servers (see cloud hosting providers)
Cloudflare	Free tier	Easy	Sites that also want a CDN and firewall
Paid OV / EV certificate	Paid	Medium	Stores and companies needing validated identity and support

Free and paid certificates encrypt identically. Paid ones add organization validation, a warranty and support. Dedicated hosts for stores are covered in our fastest WooCommerce hosting list.

Install the certificate (4 methods)

Method 1: Your hosting panel (easiest)

1. Log in to cPanel, hPanel, Plesk or your host’s dashboard.
2. Open SSL/TLS, Security or Let’s Encrypt.
3. Select your domain (include the www version) and click Install / Issue.
4. Wait a few minutes, then open https://yourdomain.com. A padlock means it worked.

If validation fails, check DNS propagation, remove conflicting CAA records, and make sure no security rule blocks /.well-known/acme-challenge/. Some hosts (older Bluehost and iPower setups, for example) require CNAME or email validation or a purchase before assigning the certificate, so ask support if the panel stalls.

Method 2: Certbot on your own server

sudo apt update && sudo apt install certbot python3-certbot-nginx   # or python3-certbot-apache
sudo certbot --nginx -d example.com -d www.example.com               # or --apache
sudo certbot renew --dry-run                                         # test auto-renewal

Certbot edits your server config, installs the certificate and sets up renewal. Running Nginx? Our Nginx optimization and Nginx vs LiteSpeed articles help with the next steps.

Method 3: Cloudflare

Point your nameservers to Cloudflare, open SSL/TLS, and choose Full (strict). Avoid Flexible: it encrypts only visitor-to-Cloudflare, which causes redirect loops and leaves your origin unencrypted. Install a free Cloudflare Origin Certificate or Let’s Encrypt on your server for Full (strict).

Method 4: Buy a paid certificate

1. Generate a CSR in your hosting panel (SSL/TLS → Certificate Signing Requests).
2. Buy the certificate from a CA or reseller and paste in the CSR.
3. Complete domain (and for OV/EV, organization) validation by email, DNS record or file upload.
4. Download the .crt and CA bundle, then upload them in SSL/TLS → Manage SSL sites.

About SSL plugins: plugins such as Really Simple SSL don’t issue a certificate by themselves. They help WordPress use one you already installed (URL updates, redirects, mixed-content fixing). Use one if you prefer a no-code route, but don’t leave it as a permanent substitute for a proper server-level redirect.

Switch WordPress to HTTPS

Go to Settings → General, change both URL fields to https:// and save. You’ll be logged out; sign in again.

If the fields are greyed out, the URLs are fixed in wp-config.php. Edit them there:

define( 'WP_HOME',    'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );
define( 'FORCE_SSL_ADMIN', true );

Behind a load balancer or reverse proxy, add this above the /* That's all, stop editing! */ line so WordPress detects HTTPS:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
    $_SERVER['HTTPS'] = 'on';
}

Update old URLs in the database

Posts, widgets and page-builder data still contain http:// links and image URLs. Take a backup, then use WP-CLI, which handles serialized data safely:

wp search-replace 'http://example.com' 'https://example.com' --all-tables --skip-columns=guid --dry-run
wp search-replace 'http://example.com' 'https://example.com' --all-tables --skip-columns=guid

No terminal? Install Better Search Replace, enter the old and new URL, select all tables, run with Dry Run ticked, then run again unticked. Keep the guid column unchanged.

Force HTTPS with a 301 redirect

Without a redirect, the HTTP and HTTPS versions both stay live, which creates duplicate content. A permanent 301 sends visitors and Google to one address.

Apache (.htaccess), placed above the WordPress block:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

Nginx:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Old or parked domains should point to the main domain too (and also need their own certificate if Google ever indexed their HTTPS version):

RewriteEngine On
RewriteCond %{HTTP_HOST} ^(www\.)?olddomain\.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

Once everything works for a few weeks, consider adding HSTS so browsers always use HTTPS: Strict-Transport-Security: max-age=31536000; includeSubDomains. Add it only when every subdomain supports HTTPS, since it is hard to undo.

Fix mixed content

Mixed content happens when an HTTPS page loads an image, script or stylesheet over HTTP. The padlock breaks or shows a warning.

1. Open the page, press F12 (or right-click → Inspect) and go to the Console tab.
2. Look for “Mixed Content” messages and note the URL of each file.
3. Fix the source: theme options, sliders, page-builder widgets, custom CSS, hard-coded header/footer code or a plugin setting.
4. Re-run the database search and replace if media URLs are still old.
5. Clear all caches: caching plugin, host cache, CDN and browser.

Scanners like Why No Padlock or a site crawler can list every insecure URL at once. Also review your theme’s custom CSS using our custom CSS guide.

Verify and tell Google

• Check the certificate: run your domain through Qualys SSL Labs and aim for an A grade. Test both www and non-www.
• Check the redirect: curl -I http://example.com should return 301 with a Location: https://... header.
• Search Console: add a Domain property (covers http, https, www and non-www), submit your HTTPS sitemap and inspect key URLs.
• Analytics: in GA4 update the web data stream URL to HTTPS.
• Update external references: CDN origin, social profiles, email signatures, ad landing pages, payment-gateway webhooks and backlinks you control.
• Canonicals and sitemap: make sure your SEO plugin outputs HTTPS canonical URLs.

Google handles HTTP-to-HTTPS as a URL change, so expect small traffic fluctuations for a short time. Rankings normally recover when redirects are clean.

Troubleshooting common SSL errors

Error	Likely cause	Fix
ERR_TOO_MANY_REDIRECTS	Cloudflare Flexible mode, or both plugin and server redirecting	Switch to Full (strict), remove duplicate redirect rules, add the proxy snippet above
NET::ERR_CERT_COMMON_NAME_INVALID	Certificate doesn’t cover this hostname	Reissue to include both www and non-www
ERR_SSL_PROTOCOL_ERROR	SSL not enabled on the virtual host or port 443 blocked	Enable the site on 443 and open it in the firewall
Certificate expired	Auto-renew failed	Run certbot renew or renew in the panel
Padlock with warning	Mixed content	See the mixed-content section
White screen or 500 after edits	Syntax error in .htaccess or wp-config.php	Restore the backup; see fixing the 500 error and common WordPress errors

Renewals and shorter certificate lifetimes

Let’s Encrypt certificates last 90 days and renew automatically when set up correctly. Industry rules are also shrinking maximum lifetimes for public certificates, from 398 days to 200 days beginning in March 2026, with further reductions scheduled. The takeaway: automate renewal through your host, Certbot or an ACME client, and monitor expiry dates instead of relying on reminders.

After HTTPS is live, harden the rest of your site with our WordPress security checklist. If something has already gone wrong, see how to recover a hacked WordPress site.

FAQ

Is SSL free for WordPress?

Yes. Let’s Encrypt and most hosts offer free, browser-trusted certificates. Paid options add validated company identity, warranty and support.

Does HTTPS improve SEO?

It’s a lightweight ranking signal, and a proper migration with 301 redirects protects existing rankings. The practical gains come from trust, lower bounce rates and fewer browser warnings.

Why does my site still say “Not Secure” after installing SSL?

Usually mixed content, a cached page, or a certificate that doesn’t cover the www or non-www version of your domain.

Will SSL slow down my website?

Not noticeably. TLS adds only milliseconds, and HTTPS enables HTTP/2 and HTTP/3, which often improve load time.

Do I need SSL for a localhost or staging site?

Not for local testing (see our WordPress localhost guide), but staging sites that mirror production should use HTTPS to catch mixed-content bugs early.

How often must I renew an SSL certificate?

Free Let’s Encrypt certificates renew every 60–90 days automatically. Paid certificates have shorter maximum lifetimes each year, so enable auto-renew wherever possible.

Conclusion

Installing SSL in WordPress comes down to a clear order: back up, issue the certificate, switch the site URLs, update the database, force one canonical HTTPS address, clean up mixed content, and notify Google. Follow that sequence and you get the padlock without losing rankings. Starting a new site? Read how to create a WordPress website and pick a fast theme from our fastest WordPress themes list.