How to Add SSL to WordPress: Step-by-Step HTTPS Guide for 2026

Originally published: November 24, 2025 · Last reviewed and updated: October 2026

Adding SSL to WordPress means two separate jobs: getting a valid TLS certificate installed on your server, and then telling WordPress (and every link in your database) to use https://. Most failed migrations come from doing the first job and skipping the second.

This guide walks through both jobs in order, explains what changed for certificates in 2026, and gives you a checklist for the mixed-content and redirect problems that show up afterwards.

The Short Answer

Ask your host to issue a free certificate (almost every host offers Let’s Encrypt or a similar CA through the control panel), then confirm https://yourdomain.com loads without a warning. Next, open Tools → Site Health in WordPress: since WordPress 5.7, Site Health detects HTTPS support and can switch your WordPress Address and Site Address to HTTPS for you. Finally, add a server-level 301 redirect from HTTP to HTTPS, fix any mixed-content warnings, and test the result with SSL Labs.

Plan for automation, not manual renewal. Under CA/Browser Forum Ballot SC-081v3, public certificates issued from March 15, 2026 can be valid for at most 200 days, falling to 47 days in 2029.

Why HTTPS Is No Longer Optional

HTTPS encrypts the connection between the visitor and your server, so login passwords, form entries, and cookies cannot be read or altered in transit. For a WordPress site, that protects your wp-admin session as much as your visitors.

Browsers now treat plain HTTP as the exception. Google announced that, starting with Chrome 154 in October 2026, the “Always Use Secure Connections” setting is on by default, which means Chrome asks for permission before loading a public site that does not offer HTTPS.

Search is a smaller factor than people often claim. Google confirmed HTTPS as a ranking signal in 2014, but described it as very lightweight compared with content quality. The real cost of staying on HTTP in 2026 is the browser warning, which drives visitors away before they read anything.

What Changed for SSL Certificates in 2026

Certificate lifetimes are shrinking across the industry. This matters for WordPress owners who still renew certificates by hand.

Let’s Encrypt is moving faster than the CA/Browser Forum minimum. According to its December 2025 announcement, the default certificate lifetime drops from 90 to 64 days on February 10, 2027 and to 45 days on February 16, 2028. If your host renews certificates automatically, you do not need to do anything except confirm that renewals are working.

Step 1: Choose Where the Certificate Comes From

You have three realistic options. Pick the one that matches how your site is hosted.

A free domain-validated (DV) certificate uses the same encryption as a paid one. Paid OV and EV certificates add identity checks on the organization, but browsers no longer show the company name prominently in the address bar, so most blogs and small business sites gain nothing from them.

Step 2: Install and Verify the Certificate

On most hosts, open the control panel, find the SSL/TLS or Security section, select your domain (and the www variant), and issue the certificate. Managed WordPress hosts often do this automatically when the domain is added.

If you use Cloudflare, set the SSL/TLS encryption mode to Full (strict). Cloudflare warns that Flexible mode causes a redirect loop when your origin server also forces HTTPS.

Before touching WordPress, open https://yourdomain.com in a private window. If the page loads (even with broken styling), the certificate is in place. If you see a certificate error, fix it at the hosting level first.

Step 3: Switch WordPress to HTTPS

You can do this in one of three ways. Use only one.

1. Site Health (recommended): go to Tools → Site Health. If WordPress detects HTTPS support, it shows an “Update your site to use HTTPS” button that updates both site URLs and rewrites old links where possible.
2. Settings → General: change WordPress Address (URL) and Site Address (URL) to https://. You will be logged out and need to sign in again.
3. wp-config.php: if you are locked out, define WP_HOME and WP_SITEURL with https:// URLs.

To force secure logins and admin sessions, the WordPress HTTPS documentation recommends this line in wp-config.php:

define( 'FORCE_SSL_ADMIN', true );

If your site sits behind a reverse proxy or CDN, the same documentation notes that WordPress may not detect HTTPS on its own, which can cause an endless redirect loop. In that case WordPress needs to read the X-Forwarded-Proto header.

Step 4: Redirect HTTP to HTTPS at the Server

Changing the site URL does not redirect old HTTP links. Add a permanent 301 redirect at the server or CDN so every http:// request lands on the https:// version. On Apache, the usual .htaccess rule is:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Nginx, LiteSpeed panels, or Cloudflare, use the “redirect to HTTPS” or “Always Use HTTPS” switch instead of editing files. Check one redirect only: http:// should go straight to https://, not through several hops.

Step 5: Fix Mixed Content

Mixed content means an HTTPS page still loads an image, script, or stylesheet over HTTP. Chrome now upgrades or blocks many of these requests, which is why a fresh HTTPS site can lose images or styling.

Use this table to find the cause quickly:

For the database step, follow a safe WordPress database search and replace process and take a backup first. Really Simple Security (formerly Really Simple SSL) can also handle HTTPS detection and mixed-content fixes if you prefer a plugin.

Step 6: Test and Monitor

Run your domain through SSL Labs to check the certificate chain, protocol versions, and configuration grade. Then open a few posts with the browser’s developer console to confirm there are no mixed-content warnings.

Finally, update every place that stores your URL: Google Search Console (add the HTTPS property if it is not a domain property), Google Analytics, your XML sitemap, and any CDN settings. If you use a CDN, our WordPress CDN setup guide covers the HTTPS settings to check.

Common Mistakes

• Using Cloudflare Flexible mode with a WordPress HTTPS redirect. This is the most common cause of redirect loops.
• Changing site URLs before the certificate works. You lock yourself out of wp-admin; test https:// first.
• Skipping the database update. Old http:// URLs in content cause mixed content for years.
• Relying on manual renewal. With 200-day limits now and shorter limits coming, a forgotten renewal takes the site offline.
• Treating SSL as a complete security plan. HTTPS protects data in transit only; see our WordPress security best practices for the rest.

FAQ

Is a free SSL certificate secure enough for WordPress?

Yes. A free DV certificate from Let’s Encrypt or your host provides the same encryption as a paid DV certificate. Paid certificates mainly add organization validation, warranties, or support.

Do I need SSL if my site has no store or login form?

Yes. Chrome now warns before loading public HTTP sites by default, and every WordPress site has a login page at wp-login.php that should be encrypted.

What happens if my certificate expires?

Visitors see a full-page security warning and most will leave. Check that automatic renewal is enabled and set up uptime or certificate-expiry monitoring.

Do I need to redo SSL when I change hosts?

Usually yes, because the certificate lives on the server. Issue a new certificate on the new host before switching DNS; our guide to migrating WordPress to a new host covers the order of steps.

The Bottom Line

Getting SSL on WordPress is quick when you work in order: install a certificate at the hosting level, switch WordPress to HTTPS through Site Health, add a single 301 redirect, and clean up mixed content. In 2026 the important extra step is making sure renewal is automatic, because certificate lifetimes are getting shorter every year. If something breaks along the way, our list of easy fixes for common WordPress issues covers redirect and white-screen problems.

Sources & Further Reading

• CA/Browser Forum: Ballot SC-081v3, Introduce Schedule of Reducing Validity and Data Reuse Periods
• Let’s Encrypt: Decreasing Certificate Lifetimes to 45 Days
• Google Online Security Blog: HTTPS by default
• Google Search Central: HTTPS as a ranking signal
• Make WordPress Core: Improved HTTPS detection and migration in WordPress 5.7
• WordPress Advanced Administration: HTTPS
• Cloudflare Docs: Full (strict) encryption mode
• Cloudflare Docs: Flexible encryption mode
• Google Online Security Blog: No More Mixed Messages About HTTPS
• Qualys SSL Labs: SSL Server Test

Articles are editorially reviewed by Jackober and factual claims are checked against cited sources.