How to enable and force SSL in WordPress
Please note that while these steps are generally straightforward, this information is provided as a suggestion and we can't provide detailed support for modifications to a Content Management System. If you require assistance with this, we'd recommend speaking to your website developer to ensure relevance and compatibility with your site.
Note: It is also possible to use tools like
Why No Padlock or
Missing Padlock to search for Mixed Content and manually update the Wordpress database.
Force SSL in Wordpress Admin
Step 1 - Log into WordPress.
Step 2 - Click on Settings > General.
Step 3 - Find the fields that say WordPress Address (URL) and Site Address (URL).
Step 4 - Change the http in both fields to https. They should look like this:
Step 5 - Scroll down to the bottom of the page and click Save Changes.
This will be sufficient to force the use of SSL on the main page: However you may find that the site does not load with a Padlock sign after this. If so, you will need to remove Mixed Content on your site as below.
Force SSL through wpconfig.php
Step 1 - Log into cPanel, and navigate to the File Manager.
Step 2 - Find and edit your wp-config.php file.
Add these two lines to your wp-config.php, and replace “yourdomain.com” with the primary domain of your Wordpress site.
define('WP_HOME', '<a href="https://yourdomain.com">https://yourdomain.com</a>');
define('WP_SITEURL', '<a href="https://yourdomain.com">https://yourdomain.com</a>');
This will be sufficient to force the use of SSL on the main page: However you may find that the site does not load with a Padlock sign after this. If so, you will need to remove Mixed Content on your site as below.
Manage Mixed Content using Really Simple SSL plugin
Note: These steps are only required if your site loads with Mixed Content. Usually a site with Mixed Content will load using HTTPS, but without the full padlock:
Step 1 - Click on Plugins > Add New and Install then Activate the Really Simple SSL plugin.
Once the plugin is installed and activated, find the plugin under the Plugins section and click on Settings.
Then click Go ahead, activate SSL!
If it's successful, you'll see this screen:
If you see the above warning about HTTP Strict Transport Security, note that it isn't currently a strict requirement like SSL is.
Replace current Mixed Content using Velvet Blues or Better Search Replace plugin
Note: These steps are only required if your site loads with Mixed Content. Usually a site with Mixed Content will load using HTTPS, but without the full padlock:
Step 1 - Click on Plugins > Add New and Install then Activate either Velvet Blues or Better Search Replace.
Step 2 - Once Installed, (1) Click Tools then (2) Click Update URLs (3) Add in the Old URL and New URL (4) Tick all the boxes except the last (5) Click Update URLs NOW.
Velvet Blues:
Better Search Replace:
automatically manages Mixed Content by redirecting HTTP resources to HTTPS as the site loads. Thus, it can cause sites to load slower in some cases. However it will also manage Mixed Content for you as long as it remains installed.
Both
Velvet Blues and
Better Search Replace manually edit your Wordpress database and update all the links to use HTTPS. There is no chance of your site loading slower, but this doesn't prevent other Mixed Content being added later.
