How to Add SSL to WordPress: Complete Step-by-Step Guide (2026)

📅 July 15, 2026 • ⏱️ 9 min read | By SSL Checker Tool Team

Adding SSL to a WordPress site involves more than just installing a certificate on the server. WordPress stores URLs in its database, and those stored URLs need to be updated to HTTPS too — otherwise you'll end up with mixed content warnings even after the certificate is installed. This guide walks through every step, in the right order.

🔒

Free SSL Checker

Verify your WordPress SSL: certificate, redirect chain, and mixed content.

Try It Free →

1 Get and Install the Certificate

Most managed WordPress hosts (Kinsta, WP Engine, SiteGround, Bluehost) issue and auto-renew a free Let's Encrypt certificate through their hosting panel with one click — check your host's dashboard before doing this manually. If you manage your own server:

# Certbot with the Nginx or Apache plugin (auto-configures the web server too)
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
# or
sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

2 Update the Site URL and Home URL in WordPress

WordPress stores its own base URLs in the database (wp_options table). Update both via Settings → General in wp-admin, or via WP-CLI for a scripted deploy:

wp option update siteurl 'https://yourdomain.com'
wp option update home 'https://yourdomain.com'

Do this after the certificate is live and serving HTTPS correctly, not before — changing these URLs while HTTPS isn't yet working will lock you out of wp-admin with redirect loops.

3 Replace Hardcoded HTTP URLs in the Database

Content written before the switch (post bodies, widget settings, theme options) often has hardcoded http:// links to images and internal pages baked directly into the database. A simple find-and-replace on the raw database is unsafe because WordPress serializes some data (arrays/objects stored as PHP serialized strings) — a naive string replace corrupts the serialization length prefixes. Use a serialization-aware tool:

# WP-CLI's search-replace is serialization-safe — use this, not raw SQL
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables --precise

# Dry run first to preview what would change
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables --precise --dry-run

4 Force HTTPS at the Server Level

Add a permanent redirect so any HTTP request is upgraded before WordPress even loads — this is more reliable than a plugin-based redirect:

# Apache (.htaccess, add near the top, before WordPress's own rules)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Nginx
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

5 Fix Mixed Content Warnings

After steps 1-4, run the SSL Checker's mixed-content scan or check your browser's DevTools console for blocked HTTP resources. Common remaining offenders: hardcoded URLs in the theme's functions.php, third-party embed codes (YouTube, social widgets) still using http://, and CDN configurations serving assets over HTTP. See our full mixed content guide for the systematic fix.

6 Update Google Search Console and Analytics

Add the https:// property in Search Console as a new, separate property (Search Console treats HTTP and HTTPS as distinct properties) and submit your sitemap under the new HTTPS property. Update your GA4 data stream's default URL to HTTPS. Skipping this step doesn't break your site, but it does mean you'll be flying blind on search performance data during the transition.

Once all six steps are done, run a full scan with our SSL Checker to confirm: valid certificate and chain, HTTPS enforced with no fallback to HTTP, zero mixed content warnings, and no redirect loops on either www or non-www.

Verify your WordPress migration is fully clean

Check your certificate, redirect chain, and scan for any remaining mixed content in one pass.

SSL Checker Mixed Content Fix Guide

← Back to Home Return to Blog

Free SSL Checker

1 Get and Install the Certificate

2 Update the Site URL and Home URL in WordPress

3 Replace Hardcoded HTTP URLs in the Database

4 Force HTTPS at the Server Level

5 Fix Mixed Content Warnings

6 Update Google Search Console and Analytics

Verify your WordPress migration is fully clean

Related Articles