How to Move WordPress from HTTP to HTTPS
Moving a WordPress website from HTTP to HTTPS is an important website configuration task. HTTPS encrypts the connection between a visitor’s browser and your web server and allows your website to use a valid SSL/TLS certificate.
For a WordPress website, simply installing an SSL certificate is not always enough. WordPress URLs, internal links, images, scripts, redirects, plugins, and external services may still reference the old HTTP address.
For example, a website may initially use:
http://example.comAfter the migration, it should use:
https://example.comThis guide explains how to safely move a WordPress website from HTTP to HTTPS, update WordPress settings, fix mixed-content problems, configure redirects, and test the website after the migration.
What Is HTTPS?
HTTPS stands for Hypertext Transfer Protocol Secure.
It uses TLS encryption to protect data exchanged between a visitor’s browser and the website server.
When HTTPS is configured correctly, visitors access the website through:
https://example.cominstead of:
http://example.comModern browsers also display security information for HTTPS connections, while HTTP websites may be marked as not secure, particularly when users enter sensitive information.
Why Move WordPress from HTTP to HTTPS?
There are several reasons to migrate a WordPress website to HTTPS.
1. Encrypts Website Traffic
HTTPS encrypts data traveling between the browser and server.
This is particularly important for:
- Login pages
- Contact forms
- Customer accounts
- Checkout pages
- Membership websites
2. Protects Website Sessions
HTTPS helps protect authentication cookies and other information transmitted between visitors and the website.
3. Enables Modern Web Features
Some browser features and web APIs require secure HTTPS connections.
4. Provides a Secure Website Connection
Visitors can access your website through a secure TLS connection instead of plain HTTP.
5. Avoids Mixed-Content Problems
Once your entire website uses HTTPS, you can eliminate resources that are unnecessarily loaded through HTTP.
HTTP vs HTTPS
| Feature | HTTP | HTTPS |
|---|---|---|
| Encryption | No TLS encryption | TLS encryption |
| URL | http:// | https:// |
| SSL/TLS certificate | Not required | Required |
| Secure data transmission | No | Yes |
| Suitable for login forms | Not recommended | Yes |
| Browser security indicators | May show insecure status | Secure connection when configured correctly |
HTTPS improves transport security, but it does not by itself make a website immune to hacking or other security problems.
Before Moving WordPress to HTTPS
Before changing your website, prepare the server and create a backup.
1. Create a Complete Backup
Back up:
- WordPress files
- Database
- Themes
- Plugins
- Media uploads
wp-config.php- Custom configuration files
A backup gives you a recovery option if something goes wrong during the migration.
2. Check Your Hosting Environment
Make sure your hosting provider supports SSL/TLS certificates.
Many hosting providers offer free certificates through services such as Let’s Encrypt.
Your hosting panel may provide an option such as:
- SSL Certificates
- SSL/TLS
- Let’s Encrypt
- Security
- HTTPS
The exact menu depends on your hosting environment.
3. Confirm Your Domain
Make sure the domain is correctly pointing to your hosting server.
For example:
example.com
www.example.comBoth versions should be configured according to your hosting setup.
Step 1: Install an SSL Certificate
The first technical step is installing a valid SSL/TLS certificate.
Your hosting provider may allow you to issue a certificate automatically.
For a typical website, the certificate should cover the domain names visitors use, such as:
example.com
www.example.comAfter installation, test:
https://example.comIf the HTTPS version opens without a certificate warning, the certificate is likely configured correctly.
Important
Do not change all WordPress URLs to HTTPS before confirming that HTTPS actually works on the server.
Step 2: Test HTTPS Before Changing WordPress
Open the HTTPS version of your website:
https://example.comAlso test:
https://www.example.comdepending on which hostname your website uses.
Check:
- SSL certificate validity
- Homepage
- WordPress login
- Images
- CSS
- JavaScript
- Important pages
If HTTPS produces certificate errors, fix the SSL configuration before continuing.
Step 3: Change the WordPress URLs to HTTPS
Once the SSL certificate works, change the WordPress URLs.
Log in to:
https://example.com/wp-admin/Go to:
Settings → General
You will normally see:
- WordPress Address (URL)
- Site Address (URL)
Change:
http://example.comto:
https://example.comFor example:
WordPress Address:
https://example.com
Site Address:
https://example.comThen click:
Save Changes
WordPress may log you out after saving. This is normal because the website URL has changed.
Log in again using:
https://example.com/wp-admin/Step 4: Change WordPress URLs Using wp-config.php
If you cannot access the WordPress dashboard, you can temporarily define the HTTPS URLs in wp-config.php.
Open:
wp-config.phpAdd:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Place the code before:
/* That's all, stop editing! Happy publishing. */Replace example.com with your actual domain.
These constants can be useful when the WordPress dashboard is inaccessible.
Step 5: Update HTTP URLs Stored in WordPress
Changing the WordPress Address and Site Address does not necessarily change every HTTP URL stored in your website database.
Your database may contain references such as:
http://example.com/wp-content/uploads/image.jpgThese should generally become:
https://example.com/wp-content/uploads/image.jpgOld HTTP references can appear in:
- Posts
- Pages
- Images
- Menus
- Widgets
- Theme settings
- Plugin settings
- Custom fields
- Page builder content
Step 6: Replace HTTP URLs Safely
For a small website, you may be able to update URLs through a suitable migration or search-and-replace tool.
For larger websites, WP-CLI is a useful option.
First create a database backup.
You can preview the changes with:
wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-runIf the results look correct, perform the replacement:
wp search-replace 'http://example.com' 'https://example.com' --all-tablesWP-CLI is preferable to a simple raw SQL string replacement because WordPress and plugins may contain serialized data.
Step 7: Configure HTTP to HTTPS Redirects
After moving to HTTPS, visitors who enter the old HTTP address should be redirected to HTTPS.
For example:
http://example.comshould redirect to:
https://example.comA permanent 301 redirect is commonly used for this purpose.
This helps visitors who still use old HTTP links reach the secure version.
HTTPS Redirect Using Apache
If your WordPress website uses Apache, you can configure the redirect through .htaccess.
A typical example is:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]Place the rule according to your existing .htaccess configuration.
Important
Do not blindly replace an existing .htaccess file. WordPress, plugins, and your hosting configuration may already have important rewrite rules.
Create a backup before modifying the file.
HTTPS Redirect Using Nginx
If your website uses Nginx, the redirect is normally configured in the server block rather than .htaccess.
A simplified example is:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}The exact configuration depends on your Nginx setup, PHP configuration, reverse proxy, CDN, and hosting environment.
If your hosting provider manages the web server, use its HTTPS redirect option where available.
Step 8: Fix Mixed Content
One of the most common problems after moving WordPress to HTTPS is mixed content.
Mixed content occurs when the main page is loaded through HTTPS but some resources are still requested through HTTP.
For example:
https://example.commay attempt to load:
http://example.com/image.jpgThis can cause browsers to block or warn about certain resources.
Common mixed-content resources include:
- Images
- CSS
- JavaScript
- Fonts
- Videos
- Iframes
- External scripts
How to Find Mixed Content
Open your website in a modern browser and check the developer console.
In Chrome-based browsers:
- Open the website.
- Press
F12. - Open the Console tab.
- Look for mixed-content warnings.
You can also inspect the page source or use a suitable website scanning tool.
Fix Mixed Content in WordPress
First make sure the database URLs have been correctly updated.
Then check:
- Theme settings
- Plugin settings
- Custom HTML
- Widgets
- Page builders
- CSS files
- JavaScript files
- Hard-coded image URLs
Change URLs such as:
http://example.comto:
https://example.comDo not automatically change third-party URLs unless the external service supports HTTPS.
Step 9: Check WordPress Media Files
Open:
Media → Library
Check several images from older posts and pages.
Make sure they load using:
https://rather than:
http://Also test featured images and images inserted into older posts.
Step 10: Clear WordPress and Server Cache
After changing URLs, clear all relevant caches.
Depending on your hosting setup, these may include:
- WordPress plugin cache
- Server cache
- Object cache
- CDN cache
- Browser cache
Then test the website in a private browser window.
Step 11: Update CDN Settings
If your website uses a CDN or reverse proxy, verify its HTTPS configuration.
Check:
- SSL mode
- HTTPS redirects
- Origin connection
- Cached URLs
- HTTP-to-HTTPS redirects
If the CDN connects to your server using HTTPS, make sure the origin server’s certificate and configuration are compatible with the selected CDN mode.
Step 12: Update External Services
Changing your site’s protocol can require updates to external services.
Check:
- Google Search Console
- Google Analytics
- Bing Webmaster Tools
- CDN
- SMTP services
- Payment gateways
- API integrations
- Webhooks
- Advertising platforms
- Social media profiles
If a service stores your website URL, update it where required.
Step 13: Update the WordPress Sitemap
Your sitemap may contain HTTP URLs if it was generated before the HTTPS migration.
Check your sitemap, for example:
https://example.com/sitemap.xmlor the sitemap URL generated by your SEO plugin.
Make sure the URLs inside the sitemap use HTTPS.
Step 14: Update Canonical URLs
SEO plugins and themes can generate canonical URLs.
Check a few pages and confirm that the canonical URL uses HTTPS.
For example:
<link rel="canonical" href="https://example.com/example-page/" />rather than:
<link rel="canonical" href="http://example.com/example-page/" />Step 15: Check Robots.txt
Open:
https://example.com/robots.txtReview any hard-coded URLs.
If your robots.txt references the old HTTP address, update it where necessary.
Step 16: Verify WordPress Login and Admin Pages
Test:
https://example.com/wp-admin/and:
https://example.com/wp-login.phpMake sure you can:
- Log in
- Open the dashboard
- Edit posts
- Upload media
- Install/update plugins
- Save settings
Step 17: Test Your Website Thoroughly
After migrating to HTTPS, don’t test only the homepage.
Check:
Front End
- Homepage
- About page
- Contact page
- Blog
- Categories
- Tags
- Search
- Important landing pages
Media
- Images
- Videos
- PDFs
- Downloads
Forms
- Contact forms
- Registration forms
- Login forms
- Newsletter forms
E-commerce
If you use WooCommerce, test:
- Product pages
- Cart
- Checkout
- Payment gateway
- Customer account
- Order emails
Common Problems After Moving WordPress to HTTPS
1. Too Many Redirects
A redirect loop can happen when multiple systems attempt to force HTTPS.
Possible causes include:
.htaccessrules- Nginx redirects
- CDN redirects
- WordPress URL settings
- Reverse proxy configuration
Make sure HTTPS is being enforced consistently rather than by conflicting rules.
2. SSL Certificate Warning
If your browser reports that the certificate is invalid, check:
- Certificate expiration
- Domain coverage
- DNS configuration
- Server configuration
- CDN SSL settings
The certificate must match the hostname visitors are accessing.
3. Images Are Not Loading
The image URL may still use HTTP.
Check the image URL and update old HTTP references where appropriate.
4. CSS or JavaScript Is Blocked
This is often related to mixed content.
Check the browser developer console to identify resources being requested through HTTP.
5. WordPress Redirects Back to HTTP
Check:
Settings → General
and verify that both URLs use HTTPS.
Also check:
WP_HOME
WP_SITEURLin wp-config.php.
6. WordPress Admin Is Not Working
If the dashboard becomes inaccessible after the change, verify the WordPress URL settings and SSL configuration.
You can temporarily use:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );in wp-config.php.
7. Website Works on HTTPS but HTTP Is Still Accessible
If the HTTP version still loads without redirecting, check your server’s HTTP-to-HTTPS redirect configuration.
Both:
http://example.comand:
http://www.example.comshould be handled according to your preferred canonical domain.
Should You Force HTTPS on Every WordPress Website?
If you have a public WordPress website, using HTTPS is generally appropriate because it protects traffic and is required for many modern web capabilities.
However, HTTPS is only one part of website security. You should also maintain:
- Strong passwords
- Updated WordPress
- Updated plugins
- Updated themes
- Regular backups
- Secure hosting
- Appropriate user permissions
- Malware monitoring
HTTP to HTTPS Migration Checklist
Use this checklist when moving your WordPress website:
- Create a complete WordPress backup
- Verify domain DNS
- Install SSL/TLS certificate
- Test HTTPS
- Change WordPress Address to HTTPS
- Change Site Address to HTTPS
- Update database URLs
- Check images
- Fix mixed content
- Configure HTTP-to-HTTPS redirects
- Clear website cache
- Clear CDN cache
- Check canonical URLs
- Check sitemap
- Check robots.txt
- Update external services
- Test WordPress login
- Test forms
- Test important pages
- Test WooCommerce checkout if applicable
- Check both
wwwand non-wwwversions - Monitor the website after migration
Frequently Asked Questions
Does moving WordPress to HTTPS require reinstalling WordPress?
No. You normally do not need to reinstall WordPress. The migration primarily involves installing an SSL/TLS certificate, updating WordPress URLs, replacing old HTTP references, and configuring redirects.
Will HTTPS change my domain name?
No. HTTPS changes the protocol, not the domain.
For example:
http://example.combecomes:
https://example.comThe domain remains example.com.
Can I move WordPress to HTTPS without a plugin?
Yes. You can migrate manually by configuring the SSL certificate, changing WordPress URLs, updating database references, and configuring server redirects.
Is an SSL certificate enough?
No. The certificate secures the HTTPS connection, but WordPress must also be configured to use HTTPS and old HTTP URLs should be reviewed.
Will my old HTTP links stop working?
They should ideally redirect to the HTTPS version using a permanent redirect. This allows visitors using older links to reach the secure version.
Can I use Let’s Encrypt for WordPress?
Yes. Let’s Encrypt provides TLS certificates that can be used for WordPress websites. Many hosting providers offer automated certificate issuance and renewal.
Will moving to HTTPS delete my WordPress content?
No. Properly moving from HTTP to HTTPS does not delete your WordPress posts, pages, media, users, or database. Nevertheless, create a complete backup before making changes.
How can I check whether my WordPress website is fully using HTTPS?
Open important pages using HTTPS and inspect the browser security indicator. Also check the browser developer console for mixed-content warnings and verify that images, scripts, stylesheets, forms, and other resources load through HTTPS.
Conclusion
Moving WordPress from HTTP to HTTPS involves more than installing an SSL certificate. A successful migration requires updating the WordPress URL configuration, replacing old HTTP references, fixing mixed content, configuring permanent redirects, and checking services such as CDNs, analytics, sitemaps, and forms.
Before starting, always create a complete backup. After the migration, test your website thoroughly to make sure visitors can access pages, images, forms, login areas, and other important functionality through HTTPS.
Once the migration is complete, continue maintaining your SSL certificate, WordPress installation, plugins, themes, and backups to keep your website secure and reliable.