Set Up SSL on WordPress in 5 Steps
Most WordPress sites only need a host setting, two address changes, a redirect and a check for mixed content. Here is the order that avoids lockouts and the padlock problems that follow.
Written by Tom George · How we research hosts
Most sites need four things, in this order: a certificate (often free from your host), two address changes in WordPress, one 301 redirect from HTTP, and a mixed-content check. No plugin in most cases.
Do it in the order below and you avoid the lockouts and padlock warnings that catch most people.
Why Put Your WordPress Site on HTTPS
HTTPS encrypts the connection between your visitor's browser and your server, which is what the padlock in the address bar means. WordPress's own documentation lists trust, payment security and avoiding the browser's "not secure" label among the reasons to use it.
Google's page experience guidance also asks whether your pages are served in a secure fashion. It does not treat HTTPS as a direct ranking boost, which we cover in our guide on whether web hosting affects SEO.
The setup takes five steps, and most of them are a few clicks. Start by checking whether your host has already done the hard part.
Before You Start: Check Whether Your Host Already Did It
Visit your site with https:// at the front. If the page loads with a padlock, a certificate is already installed and you can skip to step 2.
Let's Encrypt states that for many people, their hosting provider will get and manage certificates for them. Look for an SSL or security section in your hosting dashboard before you buy or install anything.
Step 1: Get a Certificate Installed
There are two routes. On most hosting plans, switch on the host's free SSL option in the dashboard, and the certificate is issued and renewed for you.
If you run your own server or VPS, Let's Encrypt recommends the Certbot client for most people. A paid certificate is only worth it if you need something your host or Let's Encrypt does not offer.
Not sure your plan fits? Our guide to the signs you have outgrown shared hosting covers when a basic plan stops being enough.
Step 2: Switch WordPress to HTTPS
Only do this after the certificate works. In the WordPress dashboard, go to Settings, then General, and change both the WordPress Address and the Site Address from http:// to https://.
To force logins and the admin area over HTTPS, WordPress documents one line for the wp-config.php file: define( 'FORCE_SSL_ADMIN', true );. Its documentation warns that SSL must already be configured on the server before you set it, or the site will not work properly.
Take a backup first, because a wrong address setting can lock you out of the dashboard.
Step 3: Redirect HTTP to HTTPS
Visitors and search engines can still reach your old http:// addresses, so send them to the secure version. Google's HTTPS guidance says to use a 301 (Moved Permanently) redirect to show that the HTTPS version is canonical.
Many hosts offer a one-click HTTPS redirect in the dashboard. Google also recommends a canonical link tag with the https address in the head of each page, which most SEO plugins add for you.
Step 4: Fix Mixed Content
Mixed content is the most common reason a padlock fails after the switch. It happens when a secure page still loads an image, script or stylesheet from an http:// address.
Open your key pages in a browser and check the developer console for mixed-content warnings. Then update those URLs to https://, either in the page content or the theme settings.
On a large site, a search-and-replace tool or a mixed-content plugin can save time, which is our judgment from how these fixes usually go.
Step 5: Test and Tidy Up
Check the homepage, a blog post, your login page and, if you sell online, the checkout page. Every one should load with a padlock and no warnings.
Then check that your sitemap and internal links use https addresses. If you ever see a redirect loop, WordPress's documentation says it can happen when a reverse proxy provides the SSL, and describes a header-based fix for that case.
What HTTPS Does Not Do
HTTPS protects data in transit. It does not stop your site from being hacked through an outdated plugin or a weak password.
If you are already dealing with a compromised site, start with what to do when your website is hacked.
Prefer Not to Manage SSL Yourself?
Managed WordPress hosts usually set up and renew certificates for you. Compare the Pressable and Kinsta reviews, or browse all host reviews.
Frequently Asked Questions
Is SSL free for WordPress?
Often, yes. Let's Encrypt says many hosting providers get and manage its certificates for their customers, and WordPress's own documentation notes that HTTPS is free in many cases. Check your hosting dashboard first, because paid certificates are only needed for special cases.
Do I need a plugin to enable HTTPS on WordPress?
Usually not. The certificate is installed on the server, and the rest is two address settings, a redirect and a check for mixed content. A plugin can help clean up mixed content on a large site, which is our judgment rather than a requirement.
Will HTTPS slow down my WordPress site?
WordPress's documentation says HTTPS will actually make a site faster for almost all visitors, because many efficiency improvements to HTTP are only available over HTTPS. That is WordPress's claim, and we have not measured it on our own sites.
Does HTTPS help WordPress SEO?
Only indirectly. Google's page experience guidance asks whether pages are served in a secure fashion, but says aspects beyond Core Web Vitals do not directly help a site rank higher. HTTPS is still a baseline that visitors and browsers expect.
Why does my WordPress site say Not Secure after installing SSL?
The most common cause is mixed content, where the page loads over HTTPS but some images, scripts or stylesheets still load from http:// addresses. Open the page in your browser, check the console for mixed-content warnings, and update those URLs to https://.
The Bottom Line
For most WordPress sites, SSL is a host setting, a settings change, a redirect and a quick check for mixed content. Do them in that order and take a backup before you start.
If your host charges extra or makes SSL hard to enable, that is worth weighing when you compare options in our hosting reviews.
Sources and Read Dates
All statements about WordPress, Let's Encrypt and Google were read on their own pages on October 10, 2026.
- HTTPS (WordPress Advanced Administration Handbook)
- Getting started (Let's Encrypt)
- Enable HTTPS on your servers (Google, web.dev)
- Understanding Google page experience (Google Search Central)