Adding SSL to your WordPress website and redirecting HTTP to HTTPS gives you an SEO advantage, while also improving security and building trust with your visitors. Keep in mind that SSL is free with most hosting providers. Now, let’s look at what SSL and HTTPS are and how to set them up.
The basics
What is SSL and HTTPS?
- SSL (Secure Sockets Layer): the standard technology for keeping internet connections secure and protecting sensitive data sent between two systems (it has since been replaced by TLS (Transport Layer Security), but most people still call it SSL). SSL prevents attackers from reading or modifying the information sent between the two sides. To put it simply, imagine the two sides are you and your customer: when they make a purchase on your website, their payment information is sent across. That is the short version; if you want to dig deeper, see Wikipedia.
- HTTPS (Hypertext Transfer Protocol Secure): the secure version of HTTP. It is used to communicate more safely on the internet, verify the identity of the website being visited, and protect user privacy and data integrity in transit (HTTPS requires SSL/TLS). HTTPS also helps protect websites against attacks. After redirecting HTTP to HTTPS, you may also want to enable 2-step verification in WordPress and use Wordfence Security to strengthen your website’s security.
What is the difference between free and paid SSL?
Many people who are new to websites assume that adding SSL costs money, so they put it off. Let me say it again: SSL is completely free with most hosting providers. If a provider pushes you to pay extra for it, consider steering clear of them. Below is a comparison of free and paid SSL to help you understand the difference, and in most cases, the free option is all you need.
| Criteria | Free SSL | Business SSL |
|---|---|---|
| Best for | Small and medium businesses, and websites that are not top national brands. | Large enterprises and leading national brands. For example, when you click the padlock on thegioididong.com (a major Vietnamese electronics retailer), you will see MOBILE WORLD JOINT STOCK COMPANY [VN]. |
| Provider | Let’s Encrypt, built into most hosting plans. | COMODO, GEOTRUST, THAWTE, DIGICERT… You can buy through the hosting provider you are using. |
| Benefits | The benefits listed in the section below. | The benefits listed below, plus a very high level of trust with users and search engines. |
| Paperwork | None. You can set it up yourself in your hosting control panel by following this article. | You need to provide a business license and other company documents. The process differs between providers, and they will guide you through it. |
| Cost | Free. | From 300,000 VND to 12,000,000 VND per year, depending on the package and benefits. |
Benefits of redirecting HTTP to HTTPS for websites
- Faster loading: many people think HTTPS encryption slows a website down, but that is not really the case. HTTPS comes with many improvements over HTTP that help your website load faster.
- More trust from visitors: everyone feels more comfortable visiting a website they know is safe, right? Today’s users, especially tech-savvy ones, recognize a safe website by the small padlock icon in front of the domain name. It shows that you respect the privacy of their information.
- Secure payments: when shopping on your website, buyers want their payment information to stay secure. The HTTPS padlock reassures them that their information is sent and received safely.
- SEO advantage: search engines encourage website owners to add SSL and redirect HTTP to HTTPS. Pages still on HTTP are not favored in search rankings.
- A clean-looking address bar: you have racked your brain to come up with a nice domain name. If you are still on HTTP, many browsers will put a “Not Secure” label in front of it. Not a good look, right? So add SSL and redirect HTTP to HTTPS to keep your domain looking clean and tidy.
Install free SSL on your hosting server
Most hosting providers today include cPanel in their hosting plans, so in this article I only cover adding SSL in cPanel. Other control panels work similarly but look different.
Add SSL to your website in cPanel
Step 1: Go to cPanel > SSL/TLS Status to add SSL to your website for free.
Step 2: Select all domains > click the Run AutoSSL button.
Other hosting control panels
On other control panels, look for the SSL or TLS section to install free SSL for your website. The easiest way is to contact the customer support or technical team of your hosting provider directly. They will send you the right documentation or set it up for you.
Redirect HTTP to HTTPS in WordPress
For a new website, you only need step 1, changing the website address in Settings, and step 2, redirecting HTTP to HTTPS with .htaccess in cPanel. The last 2 steps are for older websites with more content, and I explain each one in its section.
Change the website address in Settings
This is the first and simplest step in redirecting a WordPress website from HTTP to HTTPS. Go to Settings > General and change the WordPress Address (URL) and Site Address (URL) to HTTPS.
Redirect HTTP to HTTPS with .htaccess in cPanel
To automatically redirect visitors from HTTP to HTTPS, you need to add a few lines of code to the .htaccess file. Follow the steps below.
Step 1: Go to cPanel > File Manager to open your website’s file manager.
Step 2: Go to the folder that contains your website (usually public_html or a folder named after your domain) > Settings > Show Hidden Files > Save to see the .htaccess file.
If you still don’t see it, create a new file named .htaccess, with a dot in front, as shown below.
Step 3: Right-click the .htaccess file > Edit.
Step 4: Paste the 2 lines starting with RewriteCond and RewriteRule right below the RewriteEngine On line. Then click Save Changes, and you’re done.
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on [NC]
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Replace HTTP with HTTPS in the database
If your website has been around for a while and has many pages, posts, links, and images using HTTP, you need to change every HTTP link to HTTPS in the WordPress database. It sounds hard, but there is a plugin that makes it very easy. Plugins are what make WordPress so great, after all.
Step 1: In your WordPress dashboard, go to Plugins > Add New > search for Better Search Replace > Install Now, then Activate.
Warning: This replacement writes directly to your database and is hard to undo. Before you run it, back up your database (with your host’s Backup tool or an export from phpMyAdmin). Do a first pass with Run as dry run checked to see how many rows will change. Also note that replacing http:// across all tables changes links to other websites too, and those links will break if the other site does not support HTTPS. A safer option is to use your full domain, for example replace http://yourdomain.com with https://yourdomain.com.
Step 2: Go to Tools > Better Search Replace > configure it as shown below > click Run Search/Replace to change all HTTP links to HTTPS in your website’s data.
- Search for: http://
- Replace with: https://
- Select tables: select all (click any row, then press Ctrl+A)
- Run as dry run: keep it checked for the first run, check the results, then uncheck it and run again
Redirect HTTP to HTTPS in WordPress with a plugin
If your website still has HTTPS problems after the 3 steps above, this is your last resort. It handles almost every WordPress HTTP to HTTPS redirect issue.
Even if you use this method, don’t skip step 3, because if you ever turn this plugin off, your website content will go back to HTTP and break.
Issues that make this plugin necessary: mixed content caused by third-party code or plugins, and other plugins that edit .htaccess for their own purposes and sometimes remove the HTTPS redirect.
Step 1: In your WordPress dashboard, go to Plugins > Add New > search for Really Simple SSL > Install Now, then Activate.
Step 2: Go to Settings > SSL > Activate SSL to turn on the HTTP to HTTPS redirect and fix the issues you are facing.
Step 3: For best results, turn on all the options in the settings except Stop editing the .htaccess file, because some other plugins, such as caching and security plugins, need to edit .htaccess to work.
What to do after adding SSL to your website
After adding SSL and redirecting HTTP to HTTPS, don’t forget to update your website address in your search engine and analytics tools.
Edit website address in Google Analytics
If you don’t have Google Analytics yet, see how to add Google Analytics to your website to measure your traffic. If you set up Google Analytics before installing SSL, follow the instructions below to update it.
Note: Google stopped processing Universal Analytics (GA3) data in July 2023, so today you only need to update GA4. Unlike before, GA4 now lets you edit a data stream’s URL directly (10/2026). Don’t create a new stream and delete the old one, because a new stream gets a different Measurement ID and you would have to reinstall the tracking tag on your site.
Step 1: Open your web data stream. Go to Admin, under Data collection and modification click Data streams, then click the name of your website’s web stream.
Step 2: Change the URL to https. On the Web stream details screen, click the pencil icon in the upper-right corner, select https:// as the protocol, double-check the domain, then click Update stream. That’s it.
Edit website address in Google Search Console
Search Console doesn’t let you edit a property’s URL. If you use a URL prefix property with an http address, click the property name in the upper-left corner, choose Add property, and add the address starting with https://. Once it is verified, resubmit your sitemap in the new property so Google picks up the https URLs faster. Keep the old http property to follow the transition; there’s no need to delete it.
If you use a Domain property, it already covers both http and https, so you don’t need to add anything.
Conclusion
Adding SSL and redirecting HTTP to HTTPS is only a bit tricky the first time; once you get used to it, it is as easy as pie. You only have to do it once, and the benefits last a long time, so there is no reason not to.
One last, important note: check whether your hosting provider renews SSL certificates automatically. Free certificates are not permanent; they expire and need to be renewed. A good host renews them automatically. Ask your provider to be sure, so you don’t wake up one day to find a red “Not Secure” warning on your website and your search rankings taking a hit.
What do you think of this article? If you need any help, feel free to leave a comment below. I will do my best to answer and help you.
