How to Install an SSL Certificate on WordPress (and Fix Mixed Content)
An SSL certificate turns your site's address from http:// to https://, encrypts logins and form data, and removes the "Not secure" warning browsers show. Certificates are free today, and switching a WordPress site takes about 15 minutes if you follow these steps in order.
Step 1: Get the Certificate
- From your host: most hosts provide free Let's Encrypt SSL with a one-click toggle. This is the easiest option.
- On your own server: use Certbot; see Nginx + Let's Encrypt with Certbot.
- Through Cloudflare: Cloudflare encrypts traffic to visitors, but you still need a certificate on the server for a fully encrypted connection (see Step 5).
Check it works by opening https://yourdomain.com. A padlock should appear, even if some content still shows warnings.
Step 2: Update the WordPress URLs
Go to Settings > General and change both WordPress Address (URL) and Site Address (URL) from http:// to https://. Save; you will be logged out and can log back in over HTTPS.
If those fields are greyed out, the URLs are set in wp-config.php with WP_HOME and WP_SITEURL; change them there.
Step 3: Fix Mixed Content
Mixed content means the page loads over HTTPS but some images, scripts or styles are still requested over HTTP, so the padlock shows a warning. Old URLs are stored in your posts and settings, so replace them in the database. With WP-CLI:
wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run
wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid
Without WP-CLI, a search-replace plugin does the same job. Avoid raw SQL replacements, which break serialized data. Then open the browser console (F12) on a few pages to catch hard-coded http links in your theme.
Step 4: Force HTTPS at the Server
Redirect all HTTP requests to HTTPS with a permanent 301 redirect.
Nginx:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}
Apache (.htaccess, above the WordPress rules):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]
Also add this to wp-config.php to always use HTTPS for the dashboard:
define('FORCE_SSL_ADMIN', true);
Step 5: Avoid the Redirect Loop (Cloudflare and Proxies)
"Too many redirects" after enabling HTTPS usually means a proxy talks to your server over HTTP while WordPress demands HTTPS. With Cloudflare, set SSL/TLS mode to Full (strict) and install a certificate on the server instead of using Flexible. Behind other proxies, make sure they send X-Forwarded-Proto and that the server passes it to WordPress.
After the Switch
- Update the site URL in Google Search Console and Google Analytics.
- Check that internal links and your sitemap use https.
- Confirm the certificate auto-renews before it expires.
For the other security basics, read secure WordPress hosting. Moving hosts at the same time? See how to move a WordPress site.
Frequently Asked Questions
Do I need a paid SSL certificate for WordPress?
No. Free Let's Encrypt certificates are trusted by all major browsers and are fine for blogs, business sites and online stores.
Why does my WordPress site show "Not secure" after installing SSL?
Mixed content: some resources still load over http. Run a search-replace from http to https and check the browser console for the remaining links.
Does HTTPS affect SEO?
HTTPS is a lightweight Google ranking signal, and browsers warn users on non-HTTPS pages, so switching helps both rankings and trust.
RackUp IT managed WordPress hosting includes free SSL that installs and renews automatically, with HTTPS redirects already set up.
WordPress Hosting
WordPress Hosting