How to Redirect HTTP to HTTPS in WordPress

Switching your WordPress site from HTTP to HTTPS is essential for better security, SEO improvements, and user trust. Here’s how to do it:

• Install an SSL Certificate: Get one from your hosting provider or a Certificate Authority.
• Back Up Your Site: Save your database and files before making changes.
• Redirect HTTP to HTTPS:
  • Use a plugin like Really Simple SSL for an easy setup.
  • Edit your .htaccess file for manual control.
  • Adjust server settings for advanced configurations.
• Fix Mixed Content: Update all HTTP links to HTTPS to avoid errors.

Quick Tip: Test your setup using tools like "Why No Padlock" and update your WordPress URLs to HTTPS in the settings. This ensures a smooth and secure transition for both visitors and search engines.

How to Properly Redirect WordPress from HTTP to HTTPS

Before You Start

Before switching from HTTP to HTTPS, make sure to complete these essential steps for a smooth and secure transition.

Get an SSL Certificate

An SSL certificate is what makes HTTPS possible. It verifies your site’s identity and encrypts the data exchanged between your server and visitors.

Here are your options for obtaining an SSL certificate:

• Through Your Hosting Provider: Many WordPress hosting services, like Bluehost, WP Engine, and GoDaddy, include free SSL certificates as part of their hosting plans. This is often the simplest option since the host usually handles the setup for you.
• From a Certificate Authority (CA): You can also buy a certificate directly from a trusted Certificate Authority. These certificates typically include your domain name, proof of ownership, the issuing authority’s digital signature, and encryption keys, along with issue and expiration dates.

Once your SSL certificate is in place, it’s time to back up your website.

Create a Website Backup

Backing up your site is crucial before making any major changes. Here’s how you can do it:

• Database Backup:
  Use phpMyAdmin to export your WordPress database. Select your database, click on ‘Export,’ choose the ‘Quick’ option, and download the SQL file.
• Files Backup:
  You can back up your files in several ways:
  • cPanel: Go to File Manager, compress the contents of your public_html folder, and download the ZIP file.
  • FTP: Use an FTP client like FileZilla to connect to your site and download all files from the root directory.
  • Backup Plugin: Install a plugin like Duplicator, adjust the settings, and create a full backup.

Store your backups in both cloud storage and a local device. This ensures you can quickly restore your site if anything goes wrong during the HTTPS setup.

Setting Up HTTPS Redirection

To ensure your website is secure, you need to enforce HTTPS. Here are a few methods you can use to set it up.

Plugin Method

Using a WordPress plugin is the easiest way to enable HTTPS redirection. A popular choice is Really Simple SSL. Here’s how to use it:

• Install and activate the Really Simple SSL plugin from your WordPress dashboard.
• Go to Settings > SSL.
• Click on "Activate SSL!".
• Clear your website cache.

Other plugins like Easy HTTPS Redirection and WP Force SSL & HTTPS SSL Redirect can also get the job done.

.htaccess File Method

If your site is hosted on an Apache server, you can directly modify the .htaccess file to enforce HTTPS. Follow these steps:

Step	Action	Important Note
Access Root Directory	Use an FTP client or your hosting file manager	Ensure you have the right permissions.
Backup .htaccess	Create a copy of your current .htaccess file	Keep the backup in a safe location.
Edit .htaccess	Add redirection code to the file	Use a plain text editor for changes.
Test Changes	Check HTTP and HTTPS access to your site	Look out for 404 errors.

Add this code to the top of your .htaccess file:

RewriteEngine On  
RewriteCond %{HTTPS} off  
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Server Configuration Method

For server-level redirection, the process depends on your hosting setup:

• Nginx: Add a redirect block to your nginx.conf file.
• Cloudflare: Log into your Cloudflare dashboard, navigate to SSL/TLS settings, and enable "Always Use HTTPS".

Once you’ve made the changes, test your site thoroughly to ensure all pages and resources load using HTTPS. For more WordPress security advice, check out 8DegreeThemes (https://8degreethemes.com).

sbb-itb-a010687

Check Your Redirection Setup

Once you’ve set up HTTPS redirection, it’s essential to test your site to make sure visitors are always directed to the secure version.

Test Website Access

Check both the HTTP and HTTPS versions of your site to ensure redirection works properly:

• Open your site using HTTP (e.g., http://example.com) and confirm it redirects to HTTPS.
• Look for the padlock icon in the browser, which signals a secure connection.
• Verify that all pages load without errors and remain secure.

Keep an eye out for potential issues like:

• Mixed Content: This happens when some elements (like images or scripts) still load over HTTP, causing the padlock to disappear.
• Redirect Loop: Endless redirections that prevent the page from loading.
• Certificate Errors: Problems with your SSL certificate, such as an invalid or expired installation.

SSL Test Tools

To confirm your SSL setup is working correctly, try these tools:

• Why No Padlock (whynopadlock.com): Checks for SSL certificate validity, mixed content, and redirection issues.
• Use your browser’s developer tools (press F12) alongside an online SSL checker to verify certificate details and redirection behavior.

If you run into problems, you can use the diagnostic tools included with Really Simple SSL. Also, clear your browser’s cache and cookies to ensure you’re viewing the latest configuration.

Once you’ve confirmed everything works as expected, update your WordPress URLs and fix any mixed content to fully secure your site.

Final Setup Steps

Once HTTPS redirection is set up, it’s time to wrap up your migration by adjusting site settings and search engine configurations.

Update WordPress URLs

Head to Settings > General in your WordPress dashboard and update both the WordPress Address (URL) and Site Address (URL) to include HTTPS. If these fields are locked, you’ll need to make changes directly in the database or the wp-config.php file.

To ensure all HTTP links in your database are updated to HTTPS, use the Better Search Replace plugin. This helps you catch any lingering HTTP URLs across your site.

Fix Mixed Content

Mixed content errors happen when your site loads both secure (HTTPS) and insecure (HTTP) resources. These issues can undermine security and user confidence.

Here’s how to address them:

• Use browser developer tools (press F12) or tools like WhyNoPadlock? to find insecure elements on your site.
• Install the SSL Insecure Content Fixer plugin to automatically handle many mixed content issues.

For a more thorough fix:

• Replace absolute HTTP paths in your theme files with relative URLs.
• Update external resource links (like images and scripts) to use HTTPS.
• Run Better Search Replace again to update any remaining database entries.

Update Search Engine Settings

After resolving mixed content, let search engines know about your HTTPS migration. Since search engines see HTTP and HTTPS as separate versions, you’ll need to configure this properly.

• Add your HTTPS site as a new property in Google Search Console.
• Submit an updated XML sitemap reflecting the HTTPS URLs.
• Update your robots.txt file to ensure it aligns with your new HTTPS setup.

These steps will help search engines recognize and prioritize your secure version.

Summary

Switching from HTTP to HTTPS enhances security, boosts SEO, and increases user confidence. You can achieve this using plugins, .htaccess edits, or server configuration.

Start by installing an SSL certificate and backing up your site.

"Changing your website URL’s prefix from HTTP to HTTPS is an important step in securing your website overall, improving your page rank and SEO trustworthiness, and giving your users (and yourself) peace of mind." – Haley Walden, Elegant Themes

Here’s what to do:

• Verify SSL Installation: Ensure your SSL certificate is installed and active.
• Pick a Redirection Method: Use plugins like Really Simple SSL, make .htaccess changes, or adjust server settings.
• Update Site Settings: Change WordPress URLs and database entries to HTTPS.
• Fix Mixed Content: Replace any remaining HTTP links or resources.
• Update Search Tools: Submit an updated sitemap and configure search console settings.

Clear your cache to apply these changes. Google favors HTTPS websites in search rankings, so this isn’t just about security – it’s also key for better visibility online .

After completing the migration, keep an eye on your SSL status and check for mixed content issues whenever you add new features or content to your WordPress site.

Related Blog Posts

• Common WordPress Errors: Solutions and Quick Fixes
• How to Create a WordPress Child Theme: Step by Step
• How to Manually Backup WordPress Files and Database