How to Force HTTPS on Your Website (WordPress and .htaccess)

After installing an SSL certificate, people can still reach the insecure http:// version of your website unless you redirect them. Forcing HTTPS ensures every visitor and search engine uses the secure version, and it avoids duplicate versions of your pages in search results.

Before you begin

• Confirm SSL works: open https://yourdomain and check for the padlock. Never force HTTPS before a valid certificate is installed. See how to install free SSL in cPanel.
• Take a backup of your website files, especially .htaccess, and your database.
• Choose one method from the options below. Using several at once is the most common cause of redirect loops.

Method 1: Update WordPress settings

1. Go to Settings → General.
2. Change WordPress Address (URL) and Site Address (URL) to begin with https://.
3. Save changes. You may need to log in again.

This makes WordPress generate HTTPS links, but it does not always redirect visitors who type or follow old HTTP links, so combine it with Method 2 or 3.

Method 2: Redirect with .htaccess (Apache and LiteSpeed)

On Apache or LiteSpeed servers, a rule in the .htaccess file in your website’s root folder can redirect all HTTP requests to HTTPS with a permanent 301 redirect.

1. Open File Manager in cPanel and go to your website’s root folder, often public_html.
2. Enable Show hidden files if you cannot see .htaccess.
3. Download a copy of the file as a backup.
4. Add the following near the top of the file, above the # BEGIN WordPress section:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]

5. Save the file and test by visiting http://yourdomain. It should change to https:// automatically.

If your site is behind a CDN or proxy that handles SSL, this rule may cause a loop. In that case, use the CDN’s HTTPS redirect setting instead.

Method 3: Use the hosting control panel

Some cPanel accounts provide a Force HTTPS Redirect toggle in the Domains section. Turning it on creates the redirect for you without editing files.

Method 4: Use a plugin

SSL and security plugins can handle redirects and some mixed content issues. This is convenient for beginners, but avoid combining a plugin redirect with .htaccess or control panel redirects.

After forcing HTTPS

• Fix mixed content: update any images or scripts still loading over HTTP. See fixing mixed content warnings.
• Update Google Search Console and analytics to use the HTTPS version.
• Update links in social media profiles, email signatures and online directories.
• Clear caches in your caching plugin, CDN and browser.

Troubleshooting redirect loops

If you see ERR_TOO_MANY_REDIRECTS:

1. Remove the redirect you most recently added.
2. Disable redirect or SSL plugins temporarily.
3. Check CDN or proxy SSL settings.
4. Clear cookies and cache, then test again.

More fixes are in common SSL certificate errors.

Final thoughts

A single, correctly configured HTTPS redirect keeps every visitor on the secure version of your site. If you are not comfortable editing server files, ask Salama Hosting support to help.