How to force HTTPS on your website

Once your site has an SSL certificate, send every visitor to the https:// address. This guide shows four ways to do it, starting with the simplest.

In cPanel

Open Domains in cPanel and turn on Force HTTPS Redirect for your domain. This only works once the domain has a valid certificate. Visit your site with http:// to check that it moves to https://.

With .htaccess

Add these lines at the top of the .htaccess file in public_html. Keep a copy of the file first.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

The 301 tells browsers and search engines that the move is permanent.

On WordPress

In Settings > General, change both addresses to start with https://. To keep the dashboard on HTTPS, add this line to wp-config.php:

define('FORCE_SSL_ADMIN', true);

Then replace old http:// links in your content, for example with the Better Search Replace plugin. Back up first.

With Cloudflare

If your site runs through Cloudflare, set SSL/TLS to Full or Full (strict) and turn on Always Use HTTPS. Automatic HTTPS Rewrites fixes many mixed content links. Don't use Flexible: with a redirect on our side, it causes a redirect loop.

Fix mixed content

If the padlock shows a warning after the switch, some files still load over http://. The Console tab in your browser's developer tools lists them. Change those links to https://, or remove them.

If something goes wrong

• Too many redirects. Two redirects are probably fighting each other, for example one in cPanel and one in .htaccess, or Cloudflare set to Flexible. Keep one.
• Certificate error after the redirect. The certificate doesn't cover the name you used, such as www. Check SSL/TLS Status. See How to install and manage SSL certificates.

Once everything works on HTTPS, you can add HSTS to tell browsers to always use HTTPS. See MDN's guide to Strict-Transport-Security.

Related guides

• How to install and manage SSL certificates
• How to secure your WordPress site
• WordPress troubleshooting: common errors and fixes