How to Install a Free SSL Certificate on WordPress and Switch to HTTPS

WordPress powers a huge share of the websites on the internet. In this guide we walk you through installing a free SSL certificate on your WordPress site and migrating it to HTTPS without breaking anything. The job comes down to uploading the certificate to your server, updating the WordPress addresses, and cleaning up mixed content.

Why is HTTPS essential?

HTTPS encrypts the traffic between visitors and your site, so login details and form data cannot be read by third parties. Browsers also flag non-HTTPS sites as "Not secure" in the address bar, and Google uses HTTPS as a ranking signal. In short, SSL is required for both trust and SEO.

Step 1 — Upload the certificate to your server

First, get a certificate for your domain. If you don't have one yet, use our free SSL wizard to verify your domain and create a certificate valid for 90 days in minutes. Upload the certificate.crt, private.key and ca_bundle.crt files from the downloaded ZIP to your hosting panel (in cPanel: SSL/TLS → Manage SSL sites). Once the server-side install is done, https://yourdomain.com should open with a padlock in the browser.

Step 2 — Set the WordPress addresses to HTTPS

In the WordPress dashboard go to Settings → General and update both fields with https://:

  • WordPress Address (URL)
  • Site Address (URL)

You may be logged out after saving; just log back in. If you can't reach the dashboard, define the same values in wp-config.php:

define('WP_HOME','https://yourdomain.com');
define('WP_SITEURL','https://yourdomain.com');

Step 3 — Fix mixed content

If images, styles, or scripts in old posts are still referenced with http://, the browser shows a "mixed content" warning and the padlock looks broken. Use a reliable search-and-replace tool (for example the Better Search Replace plugin) to bulk-update old links in the database, replacing http://yourdomain.com with https://yourdomain.com. Run the plugin's "dry run" option first so you don't corrupt serialized data.

Step 4 — Redirect all traffic to HTTPS

To permanently move visitors arriving over http:// to the secure version, add this rule to the .htaccess file in your site root (Apache/LiteSpeed):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

A 301 redirect both sends visitors to the secure version and tells Google the move is permanent, preventing SEO value loss.

Step 5 — Verify

Open your site with https://, check the padlock and a few old posts. There should be no mixed-content warnings in the developer console (F12). Finally, add the https version as a separate property in Google Search Console and resubmit your sitemap.

Common issues

  • Infinite redirect loop: usually happens behind a CDN/proxy. Check the proxy setting that forwards the X-Forwarded-Proto header to WordPress.
  • Padlock still broken: there are still http:// links embedded in a theme or plugin; the console warning shows which file.

Summary

Migrating WordPress to HTTPS is a matter of uploading the certificate, setting the addresses to https, cleaning up mixed content, and adding a 301 redirect. If you don't have a certificate, create one now with our free SSL wizard and renew it for free every 90 days using the same steps.