HTTPS Setup
How to Force HTTPS in WordPress After Installing SSL
Installing a certificate doesn't automatically redirect anyone — WordPress still needs to be told to serve every page over HTTPS, not just allow it.
Free
Auto-renewing SSL to redirect to
301
Redirect type used for HTTPS enforcement
24/7
Human support for redirect issues
30-day
Money-back guarantee
In short
To force HTTPS in WordPress, update the WordPress Address and Site Address in Settings > General to use https://, add a 301 redirect rule to the site's .htaccess file so any HTTP request is automatically sent to the HTTPS version, and fix any hardcoded http:// links in post content or theme files to prevent mixed-content warnings. A plugin like Really Simple SSL can automate most of these steps for site owners who'd rather not edit .htaccess directly.
Once HTTPS is fully enforced with no mixed content, enabling HSTS adds a further instruction telling browsers to only ever connect to the site over HTTPS, even if a visitor manually types http://.
Installing an SSL certificate makes HTTPS available on a WordPress site, but it doesn't make HTTPS mandatory. Without an explicit redirect, both http://yoursite.com and https://yoursite.com stay reachable, which means search engines can index both versions as separate pages, some visitors land on the insecure version by habit or an old bookmark, and any internal link still pointing to http:// quietly serves an unencrypted page even though a perfectly good certificate is sitting right there unused.
Forcing HTTPS closes that gap with a few concrete changes: correcting the site URLs stored in WordPress itself, adding a redirect rule at the server level so nothing slips through, cleaning up mixed content left behind in old posts or theme files, and finally, once everything checks out, enabling HSTS as a stronger, browser-level guarantee that HTTP is never used again for that domain.
Step One: Update the Site URLs in WordPress Settings
In the WordPress dashboard, go to Settings > General and change both the WordPress Address (URL) and Site Address (URL) fields from http:// to https://. This tells WordPress itself, at the application level, that the canonical version of every URL it generates — permalinks, admin links, asset paths — should use HTTPS, which is a prerequisite for everything else working correctly.
If the site becomes unreachable or throws a redirect loop immediately after this change, it usually means the SSL certificate isn't actually active yet or isn't correctly recognized by the server, so it's worth confirming the certificate is installed and valid before making this change, not after.
Step Two: Add a 301 Redirect via .htaccess
Changing the WordPress settings alone doesn't stop someone from directly requesting the http:// version of a page. To close that gap, add a rewrite rule to the site's .htaccess file (found in the root WordPress directory, accessible via the panel's file manager or FTP) that catches any HTTP request and issues a 301 permanent redirect to the matching HTTPS URL. A 301 status specifically tells search engines the move is permanent, which is what preserves existing search rankings rather than starting them over on the new URL.
This is the step that actually enforces HTTPS server-side, independent of what WordPress's own settings say, and it's also what stops old bookmarks, external links from other sites, and search results still indexing the http:// version from ever reaching an unencrypted page.
Step Three: Use a Plugin Instead, If You'd Rather Not Edit .htaccess
A plugin like Really Simple SSL detects that a valid SSL certificate is active and automates the URL updates and redirect rule for you, which is the more approachable path for site owners uncomfortable editing server configuration files directly. Activating it typically triggers an automatic scan and a one-click fix that handles the Settings > General changes and adds the necessary redirect, without you touching .htaccess by hand.
The tradeoff is one more active plugin doing something a two-line .htaccess rule can do on its own, so larger or performance-sensitive sites sometimes prefer the manual redirect once they're comfortable with it, while smaller sites reasonably keep the plugin running indefinitely for the convenience.
Step Four: Fix Mixed Content, Then Enable HSTS
Before considering HTTPS fully enforced, check for mixed content: images, scripts, or stylesheets on an HTTPS page still being requested over http://, usually left behind from old post content or a theme's hardcoded asset URLs. Browsers block or warn about this, undermining the padlock even though the page itself loaded securely. A search-and-replace across post content, or a plugin's built-in scanner, catches most of these quickly.
Once HTTP is fully redirected and no mixed content remains, enabling HSTS (HTTP Strict Transport Security) — either through the panel's SSL settings or an .htaccess header — instructs browsers to never attempt an HTTP connection to the domain again, even if a user manually types http:// or an old link tries to load it, closing the loop entirely.
SSL Is Only Half the Job Without a Forced Redirect
A certificate that's installed but not enforced leaves a site serving two versions of itself, which confuses both search engines and visitors. Forcing HTTPS with a proper 301 redirect is what actually turns 'SSL is available' into 'this site is secure.'
Hosting Cheap's free auto-renewing SSL gives you the certificate; the redirect and HSTS steps above are what make sure every single visitor actually uses it.
- 301 redirect ensures no visitor or search engine reaches the HTTP version
- Free auto-renewing SSL means the certificate behind the redirect never lapses
- Really Simple SSL plugin automates the redirect for non-technical site owners
- HSTS locks in HTTPS-only connections once mixed content is fully resolved
Why Hosting Cheap
What you get
Free auto-renewing SSL
The certificate the HTTPS redirect relies on never expires unnoticed.
cPanel-style file access
Edit .htaccess directly through the panel's file manager without needing FTP software.
1-click plugin installers
Add Really Simple SSL or similar plugins in one click if you'd rather avoid manual redirects.
Daily backups
A safety net if an .htaccess edit or redirect rule is misconfigured and needs reverting.
24/7 human support
Get help immediately if a redirect loop or mixed-content issue appears after enforcing HTTPS.
30-day money-back guarantee
Set up and confirm HTTPS enforcement works exactly as expected, risk-free.
How It Works
Get set up in a few steps
Update WordPress site URLs to HTTPS
Change the WordPress Address and Site Address in Settings > General to https://.
Add the 301 redirect
Insert a rewrite rule in .htaccess, or activate a plugin like Really Simple SSL to add it automatically.
Fix mixed content and enable HSTS
Clear any remaining http:// links, then enable HSTS to lock the domain to HTTPS-only permanently.
Included
Everything you need, on every plan
- SSL certificate confirmed active before changing site URLs
- WordPress Address and Site Address updated to https://
- 301 redirect rule added via .htaccess or a plugin
- Old http:// version confirmed to redirect, not just load
- Mixed-content images, scripts, and stylesheets resolved
- Internal links and menus updated to https://
- HSTS enabled only after confirming no mixed content remains
- Search Console or analytics updated to track the https:// property
FAQ
Frequently asked questions
Why isn't my WordPress site redirecting to HTTPS automatically?
Updating Settings > General alone doesn't force a redirect; it only sets WordPress's own preferred URL. You need an actual 301 redirect rule in .htaccess, or a plugin like Really Simple SSL, to send HTTP requests to HTTPS server-side.
What's the safest way to force HTTPS if I'm not comfortable editing .htaccess?
Install a plugin such as Really Simple SSL, which detects your active certificate and automatically applies the URL updates and redirect for you without manual file editing.
Why do I see a 'mixed content' warning even though my SSL certificate is installed?
Mixed content means the HTTPS page is still loading at least one resource — an image, script, or stylesheet — over plain http://, usually from old post content or a theme file with a hardcoded link. Search-and-replace those references to fix it.
What is HSTS and when should I enable it?
HSTS is a header that tells browsers to only ever connect to your domain over HTTPS, even if someone types http:// manually. Enable it only after confirming the HTTP-to-HTTPS redirect works cleanly and no mixed content remains, since HSTS can make a misconfigured site harder to temporarily roll back.
Will forcing HTTPS hurt my search rankings?
No, a properly implemented 301 redirect from HTTP to HTTPS preserves existing rankings, and HTTPS itself is a positive ranking signal, so the switch is a net benefit as long as the redirect is set up correctly.
Does Hosting Cheap support HTTPS redirects and HSTS?
Yes, the panel gives full access to .htaccess and SSL/TLS settings needed to add redirects and enable HSTS, and 24/7 human support is available if a redirect loop or configuration issue comes up.
Enforce HTTPS the Right Way
Get free auto-renewing SSL and full .htaccess access to force HTTPS, from $2.09/mo.
Get Started