SSL on WordPress: how to switch to HTTPS and fix mixed content

What SSL actually does

When a visitor loads your site over HTTPS, the connection between their browser and your server is encrypted. Anyone on the same network cannot read or change what is sent, including passwords, form entries and payment details. The technology is now properly called TLS, but "SSL certificate" has stuck as the everyday name.

The certificate itself proves that the server is allowed to use your domain name. Browsers check it every time someone visits. If it is missing, expired or issued for a different name, visitors see a warning, and many will leave.

For a business site, HTTPS is no longer optional. Browsers label plain HTTP pages as not secure, and visitors are rightly wary of filling in a form on one.

Getting a certificate

Most hosts now provide free certificates, commonly from Let's Encrypt, and renew them automatically. For a typical business or club website this is all you need. Paid certificates with extra company validation exist, but they do not make the encryption stronger.

Check these points with your host:

• the certificate covers both yourdomain.co.uk and www.yourdomain.co.uk;
• it renews automatically, so it never expires unnoticed;
• it is issued only after your domain points to the host, since the certificate authority needs to reach your site to verify it.

That last point catches people out during a move. If you have just changed your domain's DNS, the certificate may not be issued until the change has spread. Our guide to moving WordPress to a new host covers the timing.

Switching WordPress to HTTPS

Having a certificate does not mean WordPress uses it. Work through these steps in order, and take a backup first.

1. Check the certificate works. Visit https://yourdomain.co.uk directly. You should see the padlock, even if the page looks odd.
2. Update the site addresses. In Settings, General, change both the WordPress Address and Site Address to start with https://. You will be logged out; log back in on the HTTPS address.
3. Update links stored in the database. Older content often contains full http:// links to your own images and pages. Use a reputable search and replace plugin to change http://yourdomain.co.uk to https://yourdomain.co.uk. Run a dry run first if the tool offers one.
4. Redirect HTTP to HTTPS. Every request to the old address should be permanently redirected to the HTTPS version. Many hosts offer a switch for this; otherwise it is a short rule in the server configuration.
5. Clear every cache. Caching plugins, the host's cache and any CDN may still serve old HTTP pages.
6. Update external places. Change the address in Google Search Console, analytics, social profiles and email signatures.

Finding and fixing mixed content

Mixed content is when an HTTPS page loads something, such as an image, script, font or stylesheet, over plain HTTP. Browsers block some of these items and show a warning or a broken padlock for others. Pages can look broken, with missing images or unstyled layouts.

How to find it

• Open the page in your browser, open the developer tools and look at the Console. Mixed content warnings list the exact address of each insecure item.
• Click the padlock or site information icon. If the browser says parts of the page are not secure, there is mixed content.
• Check several page types: home, a blog post, a page with a form, and any page built with a page builder.

Where it usually comes from, and the fix

• Old links in posts and pages: fix with the database search and replace in step 3.
• Page builder data: Elementor stores some URLs in its own data. Its Tools section includes a Replace URL option for this, and you should regenerate CSS afterwards.
• Theme or customiser settings: logos and background images set by full URL. Re-select them in the customiser.
• Hard-coded links in theme or plugin files: edit the file to use https:// or a relative path, ideally in a child theme.
• External embeds: old embed codes for maps, videos or widgets. Replace them with current HTTPS versions from the provider.

Plugins that rewrite insecure links on the fly can hide the problem, but fixing the source is cleaner and avoids extra work on every page load.

Common problems and what causes them

Too many redirects

A redirect loop usually means two systems disagree: for example, a CDN or proxy talks to the server over HTTP while WordPress insists on HTTPS. Check the SSL mode in your CDN settings and remove duplicate redirect rules.

Certificate name mismatch

The certificate covers www but not the bare domain, or the other way round. Ask your host to include both, and redirect one version to the other.

Locked out of the dashboard

If you set the site addresses to HTTPS before the certificate worked, you may not be able to log in. The addresses can be corrected in wp-config.php or directly in the database, or your host can do it for you.

HSTS set too early

HSTS tells browsers to only ever use HTTPS for your domain. It is useful, but if you enable it before everything works, visitors can be locked out until it expires. Turn it on only once the site has run cleanly on HTTPS for a while.

After the switch

Re-check your pages after the next few plugin updates, because new content can reintroduce mixed content. If you are also working on load times, our guide to speeding up a WordPress site covers caching settings that interact with HTTPS. Every WP Web Hosting plan includes SSL, so the certificate side is handled for you.

Frequently asked