How to enable and force SSL in WordPress

Please note that while these steps are generally straightforward, this information is provided as a suggestion and we can't provide detailed support for modifications to a Content Management System. If you require assistance with this, we'd recommend speaking to your website developer to ensure relevance and compatibility with your site.

Note: It is also possible to use tools like Why No Padlock or Missing Padlock to search for Mixed Content and manually update the Wordpress database.

Force SSL in Wordpress Admin

Step 1 - Log into WordPress. If you've forgotten your username or password, click here for a guide on resetting it.

Step 2 - Click on Settings > General.




Step 3 - Find the fields that say WordPress Address (URL) and Site Address (URL).




Step 4 - Change the http in both fields to https. They should look like this:




Step 5 - Scroll down to the bottom of the page and click Save Changes.




This will be sufficient to force the use of SSL on the main page: However you may find that the site does not load with a Padlock sign after this. If so, you will need to remove Mixed Content on your site as below.

Force SSL through wpconfig.php

Step 1 - Log into cPanel, and navigate to the File Manager.



Step 2 - Find and edit your wp-config.php file.

Add these two lines to your wp-config.php, and replace “yourdomain.com” with the primary domain of your Wordpress site.

define('WP_HOME', 'https://yourdomain.com');
define('WP_SITEURL', 'https://yourdomain.com');


This will be sufficient to force the use of SSL on the main page: However you may find that the site does not load with a Padlock sign after this. If so, you will need to remove Mixed Content on your site as below.

---

Manage Mixed Content using Really Simple SSL plugin

Note: These steps are only required if your site loads with Mixed Content. Usually a site with Mixed Content will load using HTTPS, but without the full padlock:



Step 1 - Click on Plugins > Add New and Install then Activate the Really Simple SSL plugin.






Once the plugin is installed and activated, find the plugin under the Plugins section and click on Settings.




Then click Go ahead, activate SSL!




If it's successful, you'll see this screen:




If you see the above warning about HTTP Strict Transport Security, note that it isn't currently a strict requirement like SSL is. If you wish to enable it, click here for our guide on how to easily do that.

Replace current Mixed Content using Velvet Blues or Better Search Replace plugin

Note: These steps are only required if your site loads with Mixed Content. Usually a site with Mixed Content will load using HTTPS, but without the full padlock:



Step 1 - Click on Plugins > Add New and Install then Activate either Velvet Blues or Better Search Replace.


Step 2 - Once Installed, (1) Click Tools then (2) Click Update URLs (3) Add in the Old URL and New URL (4) Tick all the boxes except the last (5) Click Update URLs NOW.

Velvet Blues:




Better Search Replace:

What's the difference between the two Mixed Content options?

Really Simple SSL automatically manages Mixed Content by redirecting HTTP resources to HTTPS as the site loads. Thus, it can cause sites to load slower in some cases. However it will also manage Mixed Content for you as long as it remains installed.

Both Velvet Blues and Better Search Replace manually edit your Wordpress database and update all the links to use HTTPS. There is no chance of your site loading slower, but this doesn't prevent other Mixed Content being added later.


For more information and tutorials on SSL Certificates, see our SSL Guide Repository.
For more tutorials on website development and Wordpress troubleshooting, view our List of Wordpress Guides.