Serve the site over HTTPS on WordPress

Why it matters

Without HTTPS everything visitors send and receive, including passwords and form data, can be read or changed by anyone on the network path. Browsers also label plain http pages as not secure.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Turn on the free SSL or Let's Encrypt option in your hosting control panel (or ask your host); WordPress itself does not issue certificates.
2. Stage 1: open https://example.com/ and check the pages load without warnings.
3. Stage 2: in Tools, Site Health, use the Update your site to use HTTPS button (WordPress 5.7 and later), or set both WordPress Address and Site Address to https:// in Settings, General. Then redirect http to https at the host or server.

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Stop redirecting HTTPS to HTTP
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS