Force HTTPS in WordPress the right way

Installing a certificate makes HTTPS possible; it does not make WordPress use it. To move fully to HTTPS you need three things: WordPress generating https:// links, visitors on http:// being redirected, and no insecure resources left in your pages.

Before you start

• A valid certificate: https://yourdomain.com must load without warnings. On MdmHost AutoSSL provides one for free; check cPanel → Security → SSL/TLS Status.
• A backup of the database.

Update the WordPress addresses

1. Go to Settings → General.
2. Change WordPress Address (URL) and Site Address (URL) from http:// to https://.
3. Click Save Changes and log in again.

Redirect all HTTP traffic

The simplest method on MdmHost:

1. Open cPanel → Domains → Domains.
2. Turn on Force HTTPS Redirect for the domain.

Alternatively, add this at the top of .htaccess, above the WordPress block:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Use only one method. A 301 redirect tells search engines the move is permanent so rankings transfer to the HTTPS URLs.

Secure the dashboard

Add to wp-config.php above the "stop editing" line:

define( 'FORCE_SSL_ADMIN', true );

Replace old links in content

Posts and settings still contain http:// links to your own site. Replace them with a serialisation-safe tool:

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables --skip-columns=guid

Or use the Better Search Replace plugin. Then purge LiteSpeed Cache.

Check for mixed content

Open a few pages, press F12 and look at the Console for mixed content warnings. Fix remaining http:// references in theme files, custom CSS and widgets.

Do I need an SSL plugin?

Plugins such as Really Simple SSL automate these steps, which is convenient. Done manually, as above, you avoid an extra plugin running on every request. Either way works; just do not combine a plugin's redirect with the cPanel redirect if it causes loops.

Tell search engines

• Add the https:// version in Google Search Console if you use a URL-prefix property, or use a Domain property that covers both.
• Resubmit your sitemap, which your SEO plugin now generates with HTTPS URLs.
• Update links on your social profiles and directories over time.

Troubleshooting

• Too many redirects: two redirects disagree, often Cloudflare in Flexible mode. Set Cloudflare SSL to Full (strict), and keep one redirect.
• Locked out after changing the address: define WP_HOME and WP_SITEURL in wp-config.php with the correct address.
• Padlock missing on some pages: mixed content on those templates.
• Certificate warning on www: the www name is not covered; run AutoSSL after checking its DNS.

Choose www or non-www

Decide on one preferred address, for example https://example.com, and redirect the other to it. WordPress already redirects to whatever is set in Settings → General once the request reaches PHP, but a server-level rule is faster and also covers images and files. Keep the same choice in Google Search Console, your sitemap and your social profiles so all signals point to one address.

Frequently asked questions

Will HTTPS slow my site down?

No. With modern TLS, HTTP/2 and LiteSpeed on MdmHost servers, HTTPS sites are usually faster than plain HTTP ones.

Do I need to change anything for WooCommerce?

No extra steps; once the whole site runs on HTTPS, checkout and account pages are secured too.

Next steps

• Fix mixed content warnings
• Force HTTPS redirect in cPanel
• Enable HSTS