How to Add Https to a WordPress Website

Firstly, you need to purchase and install an SSL certificate on your web server. Some of the webhosting companies already provide you a free SSL certificate, so you do not have to pay for it. The two most used free of charge SSL certificate are offered by Cloudflare and Let’s Encrypt. Or you can purchase it, the prices vary from approx. $50 to $300.

Secondly, go to the FTP of your website and open a wp-config.php file. It is located in the main folder of your website. Here, we need to change two strings – replace http for https here. Look for these two lines:

define(‘WP_SITEURL’,’http://www.’ . ($_SERVER[‘HTTP_X_WP_TEMPORARY’] ? $_SERVER[‘HTTP_X_WP_TEMPORARY’] : yourwebsiteurl.com.au’));

define(‘WP_HOME’, ‘http://www.’ . ($_SERVER[‘HTTP_X_WP_TEMPORARY’] ? $_SERVER[‘HTTP_X_WP_TEMPORARY’] : yourwebsiteurl.com.au’));

Here, change the two “http” occurrences for “https”, save and replace the file. Now, your website will start running with https:// at the beginning. You should be able to access WordPress admin via https as well.

Third step is fixing serving of mixed content. What happens usually is, that your website will server so called mixed content. Thus, the it will not be identified as secure in modern web browsers and they will display warning for your visitors. This is caused by WordPress serving some of the resources, typically images, via http. To fix this, please remove any caching mechanism you have on your website, so deactivate plugins such as W3 Total Cache, Fastest Cache and similar, turn of the caching via .htaccess if you have one and turn of http caching on your webserver. You can install a HTTP / HTTPS Remover plugin which should care for removing the mixed content. Now try loading the pages that were serving mixed content. If the problem remains, try the Https Switcher plugin. You probably do not need both of these plugins or neither of them, if you need to proceed to step four and you successfully accomplish it.

In the fourth step, if none of these plugins solved the problem completely (they typically solve the most issues), we will use a plugin Better Search Replace to replace all remaining http:// mentions in your database for those with https. Before proceeding, make a backup of your database. If you are not sure how to do it, I recommend the Updraftplus plugin, which is easy to install and make your first backup. Save the backup to your local computer or upload it to a remote storage with Updraftplus so your backup is easily accessible for you. Now go to the Better search and replace plugin. You will find it under Tools in WordPress menu. Here, enter “http://” into the Search for field and “https://” into Replace for field. Select all the tables in your database and run a dry run. Usually, dozens or hundreds of cells are identified that need updating. Now you can run the real replace.

This should fix all the issues and now if you type any of your URLs with https:// at the beginning, all content should be serve as https and all browsers should recognise your website as being secure and display the information about your certificate and encryption used. However, now your web pages are accessible via https and http as well. To redirect all your http versions to https, you can add a few lines to your .htaccess file. So we need to fix this in the fifth step. There are many articles and discussion forums out there, but most of them will not work. So, I recommend using a plugin again. Install and activate the WP Force SSL plugin. There are no settings needed for it and immediately after activating, all your http:// versions will be redirected to encrypted version of your website.