How to Install an SSL Certificate on WordPress (2026)

On this page

1. Step 1: Take a backup
2. Step 2: Issue the free SSL certificate in your hosting panel
3. Step 3: Check the certificate in the browser
4. Step 4: Change the WordPress and Site Address to https
5. Step 5: Force HTTPS with a 301 redirect
6. Step 6: Fix mixed content
7. Step 7: Update Search Console and analytics
8. Troubleshooting
9. FAQs

To install an SSL certificate on WordPress, issue the free certificate (usually Let's Encrypt) in your hosting panel, change both the WordPress Address and Site Address in Settings > General to https://, redirect all HTTP traffic to HTTPS, and replace old http:// links in the database so there is no mixed content. Most hosts include the certificate free and renew it automatically.

If you see "Not secure" or "Your connection is not private" after this, read SSL certificate errors explained for what each message means.

Step 1: Take a backup

Where: Hosting panel > Backups, or your backup plugin

Switching to HTTPS changes the site address. If something goes wrong you can be locked out of the admin, so take a full backup (files and database) first. The UpdraftPlus backup tutorial shows one way to do it.

Step 2: Issue the free SSL certificate in your hosting panel

Where: hPanel > Security > SSL (cPanel: SSL/TLS Status or Let's Encrypt)

1. Log in to your hosting panel and open the SSL section.
2. Find your domain. If the status is not Active, click Install SSL (or Run AutoSSL in cPanel).
3. Choose the free certificate and make sure it covers both yourdomain.com and www.yourdomain.com.

Issuing can take from a few minutes to a few hours. It fails if the domain does not yet point at this hosting, so check DNS first.

Step 3: Check the certificate in the browser

Open https://yourdomain.com in a private window. You should see the padlock (the page may still show warnings about insecure content; that is fixed in Step 6). If the browser says the certificate is for another name, the certificate has not finished issuing or does not cover that variant.

Step 4: Change the WordPress and Site Address to https

Where: WordPress admin > Settings > General

1. Go to Settings > General.
2. Change WordPress Address (URL) and Site Address (URL) from http:// to https://. Keep www or non-www exactly as it was.
3. Click Save Changes. WordPress logs you out; log back in on the https address.

Step 5: Force HTTPS with a 301 redirect

Where: Hosting panel > Force HTTPS toggle, or .htaccess in the site root

Many panels have a Force HTTPS switch next to the certificate. Turn it on. If yours does not, add this at the top of .htaccess on Apache or LiteSpeed hosting:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]

Test by opening http://yourdomain.com/any-page/: it should land on the https version of the same page in one hop.

Step 6: Fix mixed content

Where: WordPress admin > Tools > Better Search Replace

Old posts and page-builder data still contain http://yourdomain.com links to images and pages, which cause "not fully secure" warnings.

1. Install and activate Better Search Replace.
2. Search for http://yourdomain.com, replace with https://yourdomain.com, select all tables.
3. Run it once with Run as dry run ticked, check the count, then untick it and run for real.
4. Clear every cache (plugin, host and CDN).

If you use Elementor, also run Elementor > Tools > Replace URL. Hard-coded http links in theme files or custom code need editing by hand.

Step 7: Update Search Console and analytics

• In Google Search Console, a Domain property covers https automatically. If you use URL-prefix properties, add the https version and submit /sitemap.xml there.
• In GA4, update the web stream URL to https.
• Update the website link on your Google Business Profile and social profiles.

Troubleshooting

• Too many redirects after Step 4 or 5: often a CDN such as Cloudflare set to Flexible SSL. Set it to Full (strict), or remove the extra redirect rule.
• Locked out after changing the addresses: add define('WP_HOME','https://yourdomain.com'); and define('WP_SITEURL','https://yourdomain.com'); to wp-config.php, or fix the siteurl and home rows in wp_options.
• Padlock still missing on some pages: open DevTools > Console; it lists each http resource still loading.
• Certificate will not issue: check the A record points at this host and there is no old AAAA record pointing elsewhere.

FAQs

Do I need to buy an SSL certificate for WordPress?

Usually not. Most hosts provide a free Let's Encrypt certificate that renews automatically. A paid certificate does not make the padlock more secure for a normal business site.

Will moving to HTTPS hurt my SEO?

Not if every http URL redirects with a 301 to the same https URL. Google treats it as a site move on the same domain, and rankings normally carry over.

Do I need the Really Simple SSL plugin?

It is optional. It automates Steps 4 to 6, but the manual method keeps one fewer plugin on the site. Either way the certificate itself comes from your host.