Enable HTTPS in WordPress with a valid SSL certificate

To use HTTPS in WordPress you need a valid certificate on the server and an application configuration that uses the secure address. Changing a URL in WordPress does not install the certificate.

Before changing the addresses

Check the domain's SSL coverage and test access over HTTPS without warnings. Keep a recoverable backup of the database and configuration, and note down the two current addresses.

This procedure applies to a single installation. For Multisite, installations with URLs fixed in code or websites behind a proxy, first review the specific configuration with whoever manages the website.

Change HTTP to HTTPS

1. Log in to the WordPress admin area and open Settings > General.
2. Find WordPress Address (URL) and Site Address (URL).
3. Replace only http:// with https:// in both. Keep the domain, www and any subdirectory that is already part of each address.
4. Save the changes. WordPress may ask you to log in again at the HTTPS address.

The two addresses do not have to be identical. For example, the WordPress files may be in a subdirectory and the public page at the root. Not making them match avoids breaking an installation that was already working.

If the fields are disabled, check whether they are defined with WP_HOME and WP_SITEURL in the configuration. Do not add duplicate definitions to force the change.

Redirect visits and review the content

Once the website and admin area work over HTTPS, enable the redirect from HTTP. Also test internal pages, forms and images, and clear the application or CDN caches if they keep the old addresses.

Old HTTP links may still be stored in content, widgets or plugin settings. Find insecure requests with the browser console. For a bulk replacement, use a tool that supports WordPress's serialised data, with a prior backup and a review of the changes; do not run an indiscriminate SQL replace.

If you lose access or a loop appears

Check whether you changed the domain or a path by mistake, and keep the exact message. If there is a proxy or CDN, check how it passes HTTPS on to the origin server. Do not keep adding redirect rules or accept an invalid certificate to get in.

Ask for help, giving the previous addresses and the error. You can also see the official guide to fixing WordPress URLs and how to resolve mixed content.