WordPress SSL and HTTPS Setup: Complete Security Guide

HTTPS is no longer optional — it's a requirement. Google Chrome marks HTTP sites as 'Not Secure' with a prominent warning. Google uses HTTPS as a ranking signal. Payment processing requires SSL. User trust depends on the padlock icon. After converting your website to WordPress and deploying it on hosting, SSL setup should be your first configuration step — before adding content or installing plugins. Every WordPress hosting provider offers free SSL certificates through Let's Encrypt. SSL (Secure Sockets Layer) / TLS (Transport Layer Security) encrypts data between your server and visitors' browsers. This protects login credentials, form submissions, payment information, and personal data from interception.

**On Cloudways:** 1. Applications → select site → SSL Certificate 2. Choose Let's Encrypt 3. Enter domain name and email 4. Click Install Certificate 5. Enable 'Auto Renewal' **On SiteGround:** 1. Site Tools → Security → SSL Manager 2. Select domain → Let's Encrypt 3. Click Install 4. Toggle HTTPS Enforce: ON **On Kinsta:** 1. Sites → select site → Tools 2. Enable 'Force HTTPS' 3. Kinsta uses Cloudflare SSL automatically **On cPanel Hosting:** 1. cPanel → Security → Let's Encrypt / SSL 2. Issue certificate for your domain 3. Install certificate 4. Verify at https://yourdomain.com **Using Cloudflare (Universal SSL):** 1. Add site to Cloudflare (free) 2. Change nameservers 3. SSL/TLS → set to 'Full (Strict)' 4. SSL certificate handled by Cloudflare automatically

After SSL certificate is installed: **Method 1: Really Simple SSL Plugin (Easiest)** 1. Install Really Simple SSL 2. Activate → click 'Go ahead, activate SSL!' 3. Plugin handles everything: URL changes, mixed content, redirects **Method 2: Manual Configuration** Update WordPress URLs: 1. Settings → General 2. Change both WordPress Address and Site Address from http:// to https:// 3. Save Force HTTPS in wp-config.php: define('FORCE_SSL_ADMIN', true); Redirect HTTP to HTTPS (.htaccess): RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] **Update Internal Links:** Install Better Search Replace plugin: 1. Search for: http://yourdomain.com 2. Replace with: https://yourdomain.com 3. Run on all tables 4. This fixes mixed content from database-stored URLs

Mixed content occurs when an HTTPS page loads HTTP resources (images, scripts, fonts). Browsers block or warn about these. **Identifying Mixed Content:** • Chrome DevTools → Console → look for mixed content warnings • WhyNoPadlock.com → scan your URL • SSL Checker → enter domain for detailed report **Common Sources:** • Images inserted in content with http:// URLs • External scripts loaded over HTTP • Font files from HTTP sources • Hardcoded HTTP URLs in theme files **Fixing Mixed Content:** 1. Really Simple SSL handles most automatically 2. Use Better Search Replace for database URLs 3. Check theme files for hardcoded http:// (search and replace) 4. Update external resource URLs to HTTPS or protocol-relative (//) 5. If external resource doesn't support HTTPS, host it locally **After Fixing:** • Green padlock should appear in browser • No console warnings for mixed content • SSL Labs test (ssllabs.com) should show A or A+ rating

**HSTS (HTTP Strict Transport Security):** Tell browsers to always use HTTPS: Add to .htaccess: Header always set Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' After 30 days of stable HTTPS, submit to HSTS preload list (hstspreload.org). **Security Headers:** Add comprehensive security headers: Header set X-Frame-Options 'SAMEORIGIN' Header set X-Content-Type-Options 'nosniff' Header set X-XSS-Protection '1; mode=block' Header set Referrer-Policy 'strict-origin-when-cross-origin' Header set Content-Security-Policy "upgrade-insecure-requests" **Certificate Monitoring:** • Set up UptimeRobot SSL monitor (alerts before expiration) • Let's Encrypt certificates auto-renew every 90 days • Verify renewal is working: check certificate expiry date monthly **SSL for Subdomains:** • Wildcard certificate: covers *.yourdomain.com • Or individual certificates per subdomain • Cloudflare's free plan includes subdomain coverage **Performance Impact:** Modern SSL has negligible performance impact (<5ms per connection). Enable HTTP/2 (requires HTTPS) for significant performance improvement: multiplexed connections, header compression, and server push.