How to redirect HTTP to HTTPS in WordPress

Step by step

1. Confirm the certificate works

Open https://yourdomain.com directly. You should see your site with a padlock, even if some images are missing. A certificate warning means the certificate is not installed, expired, or does not cover the hostname you use (www and the bare domain are separate names). Fix that in your hosting panel first. Redirecting to a broken https address takes the whole site down.

2. Switch the site URLs

The quickest route: go to Tools → Site Health. If WordPress detects that https works but the site still uses http, the Your website does not use HTTPS item offers an Update your site to use HTTPS button. Clicking it changes both URLs, and WordPress puts the old values back if the site does not end up on https afterwards, for example when the addresses are fixed by constants in wp-config.php.

Manually: under Settings → General, edit WordPress Address (URL) and Site Address (URL) to start with https://, then save. You will be signed out and asked to log in again on the https address.

3. Add the redirect on Apache or LiteSpeed

Put this at the very top of .htaccess, above # BEGIN WordPress:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

If the site sits behind a proxy or CDN that terminates SSL, %{HTTPS} is always off at your server and this loops. Use the forwarded header instead: replace the condition with RewriteCond %{HTTP:X-Forwarded-Proto} !https.

4. Add the redirect on nginx

Give port 80 its own server block that does nothing but redirect:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Writing the final hostname into the target sends http://www.example.com/page/ to https://example.com/page/ in one step. Many managed hosts offer the same thing as a Force HTTPS switch, which is the better choice when it exists.

5. Test every variant for a single hop

for u in http://example.com/ http://www.example.com/ https://www.example.com/ http://example.com/a-post/; do
  curl -sI "$u" | grep -iE "^HTTP|^location"; echo
done

Each http address should answer 301 once, with a location that is already the final https URL. Two 301s in a row, for example http to https and then to www, is a chain. Fix it by making the server rule target the final host, as in the nginx example.

6. Clean up inside WordPress

• Open a few pages and check the browser console for mixed content warnings. Old http:// image URLs saved in posts are the usual cause; see how to fix mixed content.
• Open your sitemap and confirm every entry starts with https://.
• View a page's source and check the canonical tag. Hydrogen SEO builds it from the site address, so it follows the setting.
• Purge the page cache and CDN, which may still hold http versions of your HTML.

7. Tell search engines

In Search Console, a Domain property already covers both protocols. With URL prefix properties, add the https:// version as a new property and submit the sitemap there. The old http URLs then move to Page with redirect in the Pages report as Google recrawls them, and the https versions take their place.

Why not rely on WordPress alone

Once the site address is https, WordPress's own canonical redirect usually forwards http page requests. It runs late, though: PHP, the database and every plugin load before the redirect is sent, and it never sees requests for static files. A server rule answers in a fraction of the time and covers everything under the domain.

Add HSTS only after everything works

The Strict-Transport-Security header tells browsers to use https for your domain without asking the server first. It is a good final step, but browsers remember it for as long as the header says. Start with a short max-age, such as a day, check that every subdomain you include serves valid https, then lengthen it. Do not add it while you are still testing the redirect.