---
title: SSL/TLS
canonical: https://wpsecurityninja.com/dictionary/ssl-tls/
---
# SSL/TLS

SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.

[Full guide](https://wpsecurityninja.com/basic-guide-to-understanding-ssl-certificates/)

## Why it matters for WordPress

Login forms, cookies, and customer data should never ride cleartext HTTP. Browsers mark non-HTTPS sites as insecure, which hurts trust and SEO. HTTPS protects the pipe. It does not fix an outdated plugin with a public CVE.

## How it shows up in practice

- Padlock (or a scary certificate warning) in the browser
- Certificate expiry that takes the shop offline with a browser interstitial
- Mixed content: an HTTPS page still loading HTTP scripts or images
- Admin cookies safer in transit, but still stealable via XSS if you leave holes open

## What to do

1. Force HTTPS at the host or in WordPress site URLs.
2. Monitor certificate expiry (many hosts auto-renew Let’s Encrypt).
3. Fix mixed content so scripts and forms stay on HTTPS.
4. Keep patching; transport encryption is one layer, not the whole stack.

Guide: [HTTPS and SSL/TLS certificates](https://wpsecurityninja.com/basic-guide-to-understanding-ssl-certificates/).