24 hr Australian Support


How to enable and force SSL in WordPress


Please note that while these steps are generally straightforward, this information is provided as a suggestion and we can't provide detailed support for modifications to a Content Management System. If you require assistance with this, we'd recommend speaking to your website developer to ensure relevance and compatibility with your site.

Note: It is also possible to use tools like Why No Padlock or Missing Padlock to search for Mixed Content and manually update the Wordpress database.

Force SSL in Wordpress Admin

Step 1 - Log into WordPress. If you've forgotten your username or password, click here for a guide on resetting it.

Step 2 - Click on Settings > General.




Step 3 - Find the fields that say WordPress Address (URL) and Site Address (URL).




Step 4 - Change the http in both fields to https. They should look like this:




Step 5 - Scroll down to the bottom of the page and click Save Changes.




This will be sufficient to force the use of SSL on the main page: However you may find that the site does not load with a Padlock sign after this. If so, you will need to remove Mixed Content on your site as below.


Manage Mixed Content using Really Simple SSL plugin
Note: These steps are only required if your site loads with Mixed Content. Usually a site with Mixed Content will load using HTTPS, but without the full padlock:
7070226051c02b33c781be4c8d6cfde143f66995?t=d259d3c4948a7147f8043bf1aed750f6


Step 1 - Click on Plugins > Add New and Install then Activate the Really Simple SSL plugin.






Once the plugin is installed and activated, find the plugin under the Plugins section and click on Settings.




Then click Go ahead, activate SSL!




If it's successful, you'll see this screen:




If you see the above warning about HTTP Strict Transport Security, note that it isn't currently a strict requirement like SSL is. If you wish to enable it, click here for our guide on how to easily do that.

Replace current Mixed Content using Velvet Blues or Better Search Replace plugin
Note: These steps are only required if your site loads with Mixed Content. Usually a site with Mixed Content will load using HTTPS, but without the full padlock:
7070226051c02b33c781be4c8d6cfde143f66995?t=d259d3c4948a7147f8043bf1aed750f6


Step 1 - Click on Plugins > Add New and Install then Activate either Velvet Blues or Better Search Replace.


Step 2 - Once Installed, (1) Click Tools then (2) Click Update URLs (3) Add in the Old URL and New URL (4) Tick all the boxes except the last (5) Click Update URLs NOW.

Velvet Blues:

64146080885fdc9a39e1a9cfd4c1af005a684ae1?t=0b91e3d2334b955e0bff8dc3faa38ab9


Better Search Replace:

0f55d30ed5a8124a3792a5991e0283246748b561?t=e54142c96f1d09ba71cf046a1e118672



What's the difference between the two Mixed Content options?

Really Simple SSL automatically manages Mixed Content by redirecting HTTP resources to HTTPS as the site loads. Thus, it can cause sites to load slower in some cases. However it will also manage Mixed Content for you as long as it remains installed.

Both Velvet Blues and Better Search Replace manually edit your Wordpress database and update all the links to use HTTPS. There is no chance of your site loading slower, but this doesn't prevent other Mixed Content being added later.


For more information and tutorials on SSL Certificates, see our SSL Guide Repository.
For more tutorials on website development and Wordpress troubleshooting, view our List of Wordpress Guides.