Type any Veravix client’s domain into a browser without a certificate installed and you’ll see it straight away: a “Not Secure” warning next to the address bar, sometimes a full-page interstitial on Chrome if the site collects any form data at all. It doesn’t matter how good the design is underneath — that single warning is enough to make a visitor bounce before they’ve read a word.
The good news is that setting up an SSL certificate on a WordPress site is far simpler than it used to be. Most hosts now issue free certificates automatically through Let’s Encrypt, and the remaining work is mostly making sure WordPress itself knows to use HTTPS everywhere, not just on the login page. In my experience, this is one of the first things worth checking on any site — new build or inherited — because it affects trust, rankings, and basic data security all at once.
This guide covers checking what your host already offers, enabling the certificate, updating WordPress to serve every page over HTTPS, and cleaning up the mixed-content issues that often follow.
Quick Answer
Most WordPress hosts issue a free SSL certificate automatically or with a single click in the hosting control panel, using Let’s Encrypt. Once it’s active, update your WordPress **Site Address (URL)** and **WordPress Address (URL)** to use https://, force all traffic to HTTPS with a redirect, and check the site for any leftover http:// references that trigger mixed-content warnings.
Why This Matters
SSL used to be something only ecommerce or banking sites bothered with. That changed once browsers started actively flagging unencrypted pages, and Google confirmed HTTPS as a ranking signal. Today, a site without a valid certificate looks unfinished before a visitor even scrolls, and any contact form, login page, or checkout on that site is sending data in plain text.
There’s also a practical knock-on effect for anything else you’re running on the site. A firewall protects the server from bad requests, but it does nothing to protect the data travelling between the visitor’s browser and your site — that’s what the certificate handles. The two work together, not as substitutes for each other, and skipping one while setting up the other leaves an obvious gap.
If you’re setting up a brand-new WordPress site from scratch, SSL is usually one of the earlier steps rather than something bolted on afterwards — see the step-by-step guide to building a WordPress website for where it fits alongside hosting and domain setup.
Step-by-Step Instructions
1. Check Whether Your Host Already Provides Free SSL
Log into your hosting control panel and look for a section called **SSL**, **Security**, or sometimes just **HTTPS**. Nearly every mainstream host — Hostinger, SiteGround, Bluehost, and most managed WordPress hosts — now issues free certificates through Let’s Encrypt, a nonprofit certificate authority that automates issuance and renewal. If your host offers this, there’s rarely a reason to pay for a separate certificate on a standard content or small-business site.
2. Enable the SSL Certificate From Your Hosting Control Panel
Select your domain in the SSL section and click **Install** or **Enable**. Issuance is usually automatic and takes anywhere from a few seconds to around 20 minutes, depending on the host — it needs to verify you actually control the domain before issuing the certificate. Avoid making DNS changes while this is in progress, since that can interrupt the domain-validation check the certificate authority is running in the background.
3. Update Your WordPress Site URL and Home URL
Once the certificate is active, go to **Settings → General** in wp-admin and change both **WordPress Address (URL)** and **Site Address (URL)** from http:// to https://. Save changes and you’ll be logged out — log back in using the new HTTPS address. If the site becomes inaccessible after this step, the certificate likely hasn’t finished propagating yet; wait a few minutes and try again before troubleshooting further.
4. Force HTTPS Site-Wide
Changing the WordPress URLs doesn’t stop the old http:// address from loading — it just means WordPress generates HTTPS links going forward. To actually redirect old links and bookmarks, add a redirect rule in your .htaccess file (Apache) or your host’s redirect settings, sending all http:// requests to the matching https:// URL. Many hosts include a one-click “Force HTTPS” toggle in the same panel where you enabled the certificate, which avoids editing server files directly. This is also a natural point to review your broader header configuration — if you haven’t already, adding HTTP security headers like HSTS reinforces the HTTPS redirect at the browser level, so it doesn’t fall back to an insecure connection on a repeat visit.
5. Fix Mixed Content Warnings
After forcing HTTPS, load a handful of pages and check the browser console for mixed-content warnings — these appear when a page loads over HTTPS but references an image, script, or stylesheet still hardcoded to http://. This is common on older posts where images were uploaded before SSL was enabled. A search-and-replace tool such as **Better Search Replace** can update these references across the database in one pass; for a handful of posts, editing them manually is just as quick.
6. Verify the Certificate Is Working Correctly
Load the site in a private browser window and confirm the padlock icon appears with no warnings. Click the padlock to check the certificate’s expiry date and confirm it covers the right domain (and www variant, if you use one). A free SSL checker tool will also flag any lingering mixed-content issues or chain-of-trust problems that aren’t obvious from the address bar alone.
Practical Tips
- Confirm auto-renewal is switched on. Let’s Encrypt certificates only last 90 days, and most hosts renew them automatically, but it’s worth checking this setting once rather than assuming — a lapsed certificate causes the same “Not Secure” warning as never having one.
- If you use a CDN or caching layer such as Cloudflare, make sure its SSL mode is set to **Full (Strict)** rather than **Flexible**, otherwise traffic between the CDN and your origin server can still travel unencrypted even though visitors see a padlock.
- Update any hardcoded HTTP links in your theme’s header, footer, or widget areas — these are easy to miss because they don’t always trigger a visible console warning on every page.
- Resubmit your sitemap in Search Console after switching to HTTPS. Google treats the HTTPS version as a different URL and needs to be told which one is canonical.
Common Mistakes
- Enabling the certificate at the hosting level but never updating the WordPress Site Address — the site keeps generating HTTP links regardless of the certificate being active.
- Setting up a redirect loop by forcing HTTPS at both the server level and inside a caching plugin, which can leave visitors stuck bouncing between the two.
- Assuming SSL is a one-off task. It’s worth revisiting alongside a periodic security hardening pass, since certificate configuration and header settings tend to drift as plugins and hosting settings change.
- Leaving old HTTP versions of pages indexed in Google, which splits ranking signals between two versions of the same content instead of consolidating them under HTTPS.
When to Use This vs Alternatives
A free Let’s Encrypt certificate is the right choice for the vast majority of content sites, blogs, and small-business sites — it provides the same encryption strength as a paid certificate, just without the extra verification steps. Paid certificates matter mainly for two cases: **Extended Validation (EV)** certificates, which display the organisation’s verified legal name and suit larger financial or legal institutions, and certain enterprise setups needing a specific warranty or liability guarantee from the certificate authority. For a typical WordPress site, the free option is not a compromise — it’s simply what most established businesses use too.
Conclusion
Enable the free certificate your host almost certainly already offers, update WordPress to use HTTPS everywhere, and check for mixed-content warnings before calling it done. That last step is the one most often skipped, and it’s usually the difference between a padlock that looks right and one that actually is.
Etienne Basson works with website systems, SEO-driven site architecture, and technical implementation. He writes practical guides on building, structuring, and optimizing websites for long-term growth.