HTTPS and SSL/TLS certificates for WordPress

Browsers expect HTTPS. Certificates make that encryption possible. People still say “SSL certificate,” but modern sites use TLS. Same job: prove the site identity (at least for the domain) and encrypt traffic between the visitor and your server.

Without HTTPS, logins, form data, and cookies travel in ways that are easier to intercept on hostile networks. Google has treated HTTP as not secure for years. Checkout pages without a valid certificate lose trust immediately.

What a certificate actually does

1. The browser connects and asks the server to identify itself.
2. The server presents a certificate issued by a Certificate Authority (CA).
3. The browser checks that the certificate is valid for this hostname, not expired, and chained to a trusted CA.
4. They negotiate keys and the session is encrypted.

That handshake does not mean the WordPress install is free of malware or vulnerable plugins. HTTPS protects the pipe. You still need updates, login hardening, and backups.

Free vs paid certificates in 2026

For almost all WordPress sites, a trusted Domain Validated (DV) certificate from Let’s Encrypt (or your host’s free equivalent) is enough. Encryption strength is the same class as typical paid DV certs.

Paid OV/EV certificates add organizational vetting. Browser UI no longer treats EV as a special green-bar experience the way older guides described. Buy them when a compliance process requires them, not because a 2018 article said “big businesses need EV.”

Let’s Encrypt certificates are short-lived (about 90 days) and auto-renew when the host ACME integration is set up correctly. That renewal automation is the whole point.

How to put HTTPS on WordPress

1. Issue the certificate at the host

Most hosts: control panel → SSL/TLS → Let’s Encrypt (or “Free SSL”) → issue for the domain and www if you use it. Managed hosts often enable this by default.

2. Point WordPress at HTTPS

In Settings → General, set both WordPress Address and Site Address to https://yoursite.com (no mixed schemes).

3. Fix mixed content

After the switch, some posts still load http:// images or scripts. A migration plugin such as Really Simple SSL can help with redirects and common mixed-content fixes. Prefer fixing the site URL and content over stacking multiple “force SSL” plugins.

4. Force HTTPS at the server (optional)

If the host panel already forces HTTPS, stop there. On Apache, a minimal redirect looks like this (replace the hostname):

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

Back up .htaccess before editing. One typo can take the site offline. More context: WordPress .htaccess security.

Nginx hosts use server-block redirects instead. .htaccess rules do nothing there.

What HTTPS does not replace

• Strong admin passwords and 2FA
• Patching plugins and themes
• A firewall and malware monitoring
• Good hosting and offsite backups

Dictionary: SSL/TLS. Broader checklist: WordPress security checklist.