How to Add SSL Certificate & Enable HTTPS

Adding an SSL (Secure Socket Layer) certificate to your website is essential for securing data transmission, improving trust, and boosting SEO rankings. SSL encrypts the connection between your website and its users, ensuring that sensitive information such as passwords and credit card details remain safe from cyber-attacks.

In this guide, we will walk you through the process of adding an SSL certificate to your WordPress website and enabling HTTPS.

---

Step 1: Obtain an SSL Certificate

The first step is to obtain an SSL certificate for your website. Many hosting providers offer free SSL certificates, especially through Let’s Encrypt, a free, automated, and open certificate authority. If your hosting provider doesn’t offer SSL or you want to purchase one, you can buy an SSL certificate from third-party providers such as Comodo, DigiCert, or Symantec.

Free SSL Certificates (via Let’s Encrypt)

• Check if your host offers Let’s Encrypt: Many hosting providers offer free SSL certificates powered by Let’s Encrypt. Popular hosting providers like Bluehost, SiteGround, and WP Engine offer SSL certificates as part of their hosting packages.
• Activate the SSL certificate: If your host supports it, you can easily activate the SSL certificate from your hosting dashboard. Typically, you’ll find an option under Security or SSL/TLS settings.

Paid SSL Certificates

• If you’re purchasing a paid SSL certificate, you’ll need to go through the process of requesting the certificate, verifying domain ownership, and installing it. Your hosting provider will usually have an easy setup guide for this process.

---

Step 2: Install the SSL Certificate on Your Hosting Server

Once you’ve obtained the SSL certificate, the next step is installing it on your hosting server. Most hosts simplify this process through their dashboard. Here’s a general guide on how to install SSL on a server:

1. Access Your Hosting Control Panel: Log into your hosting provider’s control panel (e.g., cPanel, Plesk).
2. Locate the SSL Section: Find the SSL/TLS or Security section in the control panel.
3. Install SSL: If your hosting provider supports Let’s Encrypt or offers a one-click SSL installation, you can easily activate the SSL. Follow the instructions provided by your hosting provider. For a paid SSL certificate, you’ll need to upload the SSL files or enter details provided by the certificate authority.
4. Confirm SSL Installation: Once the SSL certificate is installed, you can check whether it’s active by visiting your website using https:// instead of http://. You should see a padlock icon next to the URL, indicating a secure connection.

---

Step 3: Update WordPress to Use HTTPS

Now that your SSL certificate is installed, the next step is to update your WordPress site to use HTTPS for secure connections.

Change WordPress URL and Site URL

1. Log in to WordPress Dashboard: Go to your WordPress admin dashboard.
2. Go to Settings > General: In the WordPress Address (URL) and Site Address (URL) fields, change the http:// to https://.
3. Save Changes: Click Save Changes to update your settings. Your site will now be using HTTPS.

---

Step 4: Force HTTPS on All Pages

To ensure that all pages of your website load over HTTPS (and not HTTP), you need to force HTTPS. This step is crucial, as some pages may still load with HTTP, potentially creating security vulnerabilities.

Option 1: Use a Plugin

There are WordPress plugins available that can force your website to load over HTTPS.

• Really Simple SSL:
  1. Install the Really Simple SSL plugin from the WordPress plugin repository.
  2. After activation, go to Settings > SSL.
  3. Click Go ahead, activate SSL!. This plugin automatically redirects all HTTP traffic to HTTPS.

Option 2: Update .htaccess File Manually

If you prefer not to use a plugin, you can force HTTPS by updating your website’s .htaccess file. This file is located in the root directory of your WordPress installation (access it via FTP or File Manager).

1. Access the .htaccess File: Go to the root directory of your website and find the .htaccess file. If you can’t find it, make sure your FTP client is set to show hidden files.
2. Edit .htaccess: Open the .htaccess file and add the following code to force HTTPS:
   <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
3. Save Changes: After adding the code, save and close the file.

This code ensures that any requests made to your site using HTTP are automatically redirected to HTTPS.

---

Step 5: Update Internal Links and Resources

After enabling HTTPS on your WordPress site, it’s important to ensure that all internal links and resources (like images, scripts, and stylesheets) are also loaded over HTTPS. If any resources are still loaded using HTTP, it may result in mixed content warnings, which could lead to security issues and visual inconsistencies on your site.

Update Internal Links

• You can use a plugin like Better Search Replace to replace all instances of http:// with https:// in your WordPress database.
• You can also manually update links in your content or theme files to ensure they all use HTTPS.

Fix Mixed Content Issues

• If you have resources (images, scripts, etc.) that are being loaded over HTTP, they will need to be updated to HTTPS.
• You can use the Why No Padlock tool to identify mixed content issues on your site.

---

Step 6: Update Google Search Console and Analytics

After enabling HTTPS, you need to inform Google and other search engines about the change to avoid any issues with indexing and search rankings.

1. Update Google Search Console:
   • Log into your Google Search Console account.
   • Add your HTTPS website as a new property.
   • Submit your sitemap again to make sure Google indexes the HTTPS version of your site.
2. Update Google Analytics:
   • Log into your Google Analytics account.
   • Go to Admin > Property Settings.
   • Under the Default URL field, change the URL from http:// to https://.

---

Step 7: Test Your SSL Certificate

Once you’ve added SSL and forced HTTPS, you should test the configuration to ensure everything is working properly.

• Check for the padlock icon: Visit your website and check for a padlock icon next to your URL in the browser’s address bar.
• Check for mixed content issues: Use tools like Why No Padlock or your browser’s developer tools (Console) to identify and fix any mixed content warnings.
• Test SSL: You can also use SSL Labs’ SSL Test to check the security of your SSL certificate.

---

Conclusion

Adding an SSL certificate and enabling HTTPS is an essential step for securing your WordPress site, building trust with users, and improving SEO rankings. By following these steps, you’ll ensure that all data transferred between your users and your site remains encrypted and safe. Remember to always use strong security practices and update your site regularly to keep your SSL certificate and website safe from potential vulnerabilities.