Hardening Dictionary
SSL/TLS
Definition
SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
Also called: SSL, TLS, HTTPS, SSL certificate, TLS certificate
Why it matters for WordPress
Login forms, cookies, and customer data should never ride cleartext HTTP. Browsers mark non-HTTPS sites as insecure, which hurts trust and SEO. HTTPS protects the pipe. It does not fix an outdated plugin with a public CVE.
How it shows up in practice
- Padlock (or a scary certificate warning) in the browser
- Certificate expiry that takes the shop offline with a browser interstitial
- Mixed content: an HTTPS page still loading HTTP scripts or images
- Admin cookies safer in transit, but still stealable via XSS if you leave holes open
What to do
- Force HTTPS at the host or in WordPress site URLs.
- Monitor certificate expiry (many hosts auto-renew Let’s Encrypt).
- Fix mixed content so scripts and forms stay on HTTPS.
- Keep patching; transport encryption is one layer, not the whole stack.
Guide: HTTPS and SSL/TLS certificates.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Session hijacking Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- Security headers Security headers are HTTP response headers that tell browsers how to treat your pages for safer defaults.
