How to Redirect HTTP to HTTPS in WordPress Safely Without Breaking Links

Installing an SSL certificate on your web hosting account is only the first step toward securing your website. If visitors can still access your site via standard HTTP URLs, your connection remains unencrypted and modern web browsers will flag your pages with security warnings. Setting up a proper redirect ensures all incoming traffic is automatically routed to the secure HTTPS version.

This guide explains how to transition your website correctly, update internal database records, and prevent common display issues. Before making any modifications to configuration files or your database, it is best practice to create a fresh backup using a reliable routine, such as the steps outlined in our guide on how to test and restore a WordPress backup.

Step 1: Complete Your SSL Certificate Setup

Before changing any settings inside your WordPress dashboard, verify that your SSL certificate setup wordpress configuration is fully active. Most web hosting providers offer free SSL certificates through Let’s Encrypt, which can be enabled directly within your hosting control panel (such as cPanel, Plesk, or SiteGround Site Tools).

To verify your certificate is working, open a new browser window and type https://yourdomain.com. If the page loads with a secure padlock icon in the address bar without any safety warnings, your certificate is active and ready for the next step.

Step 2: Update Your WordPress Site URLs

Next, you need to inform WordPress that your default address has changed from HTTP to HTTPS. This ensures that core links, stylesheets, and administrative scripts load securely.

1. Log in to your WordPress dashboard.
2. Navigate to Settings > General.
3. Locate the WordPress Address (URL) and Site Address (URL) fields.
4. Change both URLs from http:// to https://.
5. Scroll to the bottom of the page and click Save Changes.

Note that changing these settings will log you out of your WordPress administration area, and you will need to sign in again using your credentials.

Step 3: Force SSL via Your Server Configuration (.htaccess)

Once your dashboard URLs are updated, you must ensure that any visitor landing on an old HTTP link is permanently redirected. If your server runs on Apache, you can achieve this by implementing a wordpress https redirect htaccess rule.

Connect to your server using an FTP client or your host’s File Manager, and locate the .htaccess file in your root directory. Add the following lines of code near the top of the file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Save the file and upload it back to your server. This rule issues a permanent 301 redirect, telling search engines and web browsers that your site has permanently moved to HTTPS.

Step 4: Fix Insecure Content and Mixed Content Warnings

After forcing SSL, you may notice that pages display a broken padlock or a warning message in the browser. This typically happens when your pages load secure HTTPS elements alongside older, unencrypted HTTP resources, such as images, scripts, or stylesheets.

To fix insecure content wordpress errors, you need to update hardcoded URLs in your database and theme files:

• Use a reputable search-and-replace plugin to update old database references from http://yourdomain.com to https://yourdomain.com.
• Check your active theme files, custom CSS, or widget areas for hardcoded asset links. If you add custom styles, review safe implementation practices via our guide on how to add custom CSS to WordPress safely without breaking your site.
• Clear your caching plugins and browser cache to ensure old scripts are not being served from temporary memory.

For more detailed technical background on how web servers handle redirect status codes, you can review the documentation on HTTP redirects on MDN Web Docs.

Limitations and Cautions

While redirecting your site improves overall data privacy and browser trust, keep a few operational limits in mind:

• External Links: You cannot control external websites linking to your old HTTP URLs, but the 301 redirect ensures those visitors still arrive at your secure site safely.
• Broken Assets: Third-party widgets or external scripts that do not support HTTPS may continue to trigger warnings until you replace them with secure alternatives.
• Search Console: After completing the migration, remember to update your property settings in Google Search Console to monitor your secure URLs.

Conclusion

Migrating your website from HTTP to HTTPS is a vital step for modern web standards, security, and visitor trust. By properly updating your WordPress settings, adding server-level redirect rules, and resolving mixed content issues, you can complete the transition smoothly without losing traffic or breaking existing links.