Enable HTTPS in Joomla

First check that the domain presents a valid certificate over HTTPS and make a backup of the files and database. AutoSSL can only cover eligible names that pass validation.

In a maintained version of Joomla, go to System > Global Configuration > Server and set Force HTTPS for the entire site. The exact wording of the path may vary between versions.

Do not set $live_site as a general method. Joomla normally detects its URL, and setting it manually can cause incorrect links, problems with several domains or loops behind a proxy. Leave it empty unless documentation specific to your architecture says otherwise:

public $live_site = '';

Then test the front end, the administrator, forms and resources. When everything works, enable the HTTP to HTTPS redirect from cPanel or with a controlled rule. If there is a reverse proxy, first confirm how it passes on the original protocol.

If secure browsing shows warnings, see our guide on what is known as mixed content.

If you lose access after the change, keep access to the files and restore the previous configuration from your backup. Check the Joomla change and the redirect rule separately to find which one causes the failure. Do not disable certificate verification as a fix.

Also test an internal URL with parameters, and logging out and in. A padlock on the home page does not check forms or extension resources. Joomla's documentation on HTTPS explains the scope of Force HTTPS for the entire site.