A new WordPress site can look completely ready to launch — design done, content in place, pages published — and still show “Not Secure” in the browser address bar. That warning tells visitors your site isn’t running over HTTPS, and it has real consequences: browsers flag the site as untrustworthy, and Google treats HTTPS as a ranking signal.
The fix is straightforward in most cases, but there are several steps involved and missing any one of them leaves the problem partially unresolved. Installing an SSL certificate is only the first part. You also need to update your WordPress URL settings, force HTTP to redirect to HTTPS, and fix any mixed content errors that appear after the switch.
This guide covers each step in order, including how to identify and fix the mixed content issues that catch most people off guard.
Quick Answer
Install a free SSL certificate through your hosting panel, update your WordPress and Site Address URLs to HTTPS in Settings → General, add an HTTP to HTTPS redirect at the server level or via a plugin, then scan for and fix any mixed content errors using a plugin or by searching your database for remaining HTTP references. Verify the result with your browser’s padlock icon and a site-wide HTTPS check tool.
Why This Matters
HTTPS encrypts the connection between your server and the visitor’s browser. Without it, data passed between the two — form submissions, login credentials, anything typed on the site — is transmitted in plain text. That’s a security problem regardless of the type of site you’re running.
Beyond security, HTTPS affects trust and SEO. Chrome marks HTTP sites as “Not Secure,” which increases bounce rates significantly — many visitors leave immediately when they see that warning. Google confirmed HTTPS as a ranking factor, and most modern hosting setups make it free and easy to enable through Let’s Encrypt certificates. There’s no good reason to run a site without it.
Step-by-Step Instructions
Step 1: Install an SSL Certificate
Most hosting providers include a free SSL certificate through Let’s Encrypt. Log into your hosting control panel, find the SSL or Security section, and enable SSL for your domain. On hosts like SiteGround, Hostinger, and Kinsta this is a one-click process. On some hosts it activates automatically when you add a domain.
Once installed, your site should load at https://yourdomain.com. If it doesn’t load over HTTPS at all, the certificate isn’t active yet — check with your host’s support before moving on. There’s no point updating WordPress settings until HTTPS is actually reachable.
Step 2: Update Your WordPress URLs to HTTPS
In your WordPress dashboard, go to Settings → General. You’ll see two fields: WordPress Address (URL) and Site Address (URL). Change both from http://yourdomain.com to https://yourdomain.com and save.
This tells WordPress to use HTTPS when generating internal links, admin URLs, and asset paths. After saving, WordPress will log you out and redirect you to the HTTPS login page — that’s expected behaviour. If you configured your WordPress settings right after installation, you may have already set this correctly.
Step 3: Force HTTP to Redirect to HTTPS
Updating the WordPress URL settings doesn’t prevent people from reaching the HTTP version of your site directly. You need a server-level redirect to send all HTTP traffic to HTTPS automatically.
The cleanest option is your hosting panel’s “Force HTTPS” or “Force SSL” toggle — most managed WordPress hosts provide this. If not, add the following to your .htaccess file on Apache servers:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]On Nginx servers, the redirect goes in the server block configuration. If you’d rather not edit server files, the Really Simple SSL plugin handles this redirect automatically. I usually prefer the server-level approach since it adds no plugin overhead, but either works reliably.
Step 4: Fix Mixed Content Errors
Mixed content errors occur when your page loads over HTTPS but some resources — images, scripts, stylesheets — are still being requested over HTTP. Browsers block or flag these, and your padlock icon either disappears or shows a warning even though HTTPS is technically active.
The most common source of mixed content is old HTTP URLs stored in your WordPress database — in post content, widget settings, or theme customiser options. The Better Search Replace plugin is the most reliable way to fix this. Install it, run a search for http://yourdomain.com and replace with https://yourdomain.com across all database tables. Run it as a dry run first to see what it will change before committing.
External resources loading over HTTP — third-party scripts, fonts, or embeds that use HTTP URLs — need to be updated at the source. If a third-party script only offers an HTTP URL, consider whether you need it at all. The WordPress.org documentation on HTTPS for WordPress covers additional technical scenarios including multisite setups.
Step 5: Verify the Result
After making these changes, check your site in a browser. The address bar should show a padlock icon with no warnings. Click the padlock to confirm the certificate is valid and the connection is secure.
Then check a few key pages beyond just the homepage — a blog post, a contact page, and any page that embeds third-party content. Mixed content errors often appear on some pages but not others depending on what’s loaded. Chrome’s browser console (press F12, then go to the Console tab) will show HTTP resource errors in red if any remain.
Finally, check that Google Search Console doesn’t flag any HTTPS issues. If you have an HTTP property already verified in Search Console, add the HTTPS version as a separate property and submit your sitemap to it.
Practical Tips
Set up HTTPS before you launch the site rather than after. Switching an established site from HTTP to HTTPS can cause temporary ranking fluctuations as Google re-crawls and re-indexes the HTTPS URLs. Starting on HTTPS from day one avoids this entirely.
If you’re switching an existing site, set up a 301 redirect from HTTP to HTTPS at the server level — not just at the WordPress level. This passes link equity from any existing HTTP backlinks to the HTTPS version.
Check your SSL certificate expiry date. Let’s Encrypt certificates are valid for 90 days and should auto-renew through your host, but it’s worth verifying auto-renewal is active. A lapsed certificate takes your site back to “Not Secure” overnight.
Common Mistakes
Installing the certificate but not updating WordPress URLs. HTTPS becomes reachable but WordPress still generates HTTP links internally. The result is a site that loads over HTTPS on the surface but produces mixed content errors on every page.
Forgetting the server-level redirect. Without a redirect, both HTTP and HTTPS versions of your site exist simultaneously. This creates duplicate content issues and means some visitors still land on the insecure version.
Skipping the database search-replace. Old HTTP URLs stored in post content or theme settings cause persistent mixed content errors that don’t get fixed by anything else. Better Search Replace is the tool for this — don’t skip it.
Not checking beyond the homepage. Mixed content errors are page-specific. A clean homepage doesn’t mean the rest of the site is clean. Check multiple page types after the switch.
When to Use a Plugin vs Server Configuration
For most WordPress websites on shared hosting, the Really Simple SSL plugin is the most practical option — it handles the redirect, updates WordPress URLs, and applies basic mixed content fixes in one step. It’s a reasonable choice for sites where you don’t have easy access to server configuration files.
For sites on managed WordPress hosting or VPS setups where you have server access, handling the redirect at the server level and using Better Search Replace for the database is a cleaner approach with less plugin overhead. SSL is a foundational part of securing a WordPress website more broadly — once HTTPS is set up, it’s worth reviewing the rest of your security configuration too.
Conclusion
Install the certificate, update your WordPress URLs, force the redirect, fix mixed content, and verify. Do it once properly and you won’t need to come back to it. HTTPS is one of those foundational tasks that belongs on every site’s pre-launch list — the website launch checklist covers this alongside the other checks worth running before you go live. For the full picture of setting up a new WordPress site from scratch, the complete website building guide covers every step in sequence.
Etienne Basson works with website systems, SEO-driven site architecture, and technical implementation. He writes practical guides on building, structuring, and optimizing websites for long-term growth.