WordPress SSL and HTTPS
Some links to Bluehost are affiliate links. We may earn a commission. Disclosure.
What HTTPS does
TLS encrypts data in transit between a visitor and the website. It does not by itself guarantee that the website or its plugins are safe.
Enable it
Use a certificate supported by your host, configure the site URLs to use HTTPS, and redirect HTTP requests to the secure version.
Test the result
Look for mixed-content warnings, test forms, and check that internal links and canonical URLs use the HTTPS address.
Diagnose mixed content
If a browser still warns after HTTPS is enabled, inspect whether images, scripts, or styles load from HTTP URLs. Replace those references carefully and check for redirect loops.
Security boundary
HTTPS protects transport, not an infected plugin or stolen administrator password. Combine it with updates, access controls, and backups.
Technical reference: WordPress.org hosting requirements. Verify current recommendations before installing.
Put this guide to work
Use this short worksheet before making changes or purchasing a service. Keep your answers with your website records so you can revisit them when your needs or contract change.
- What HTTPS does: TLS encrypts data in transit between a visitor and the website. Write down what this means for your own website, identify the information you still need, and verify it using your current account or the relevant provider’s documentation. Do not substitute a general marketing claim for a plan-specific answer.
- Enable it: Use a certificate supported by your host, configure the site URLs to use HTTPS, and redirect HTTP requests to the secure version. Write down what this means for your own website, identify the information you still need, and verify it using your current account or the relevant provider’s documentation. Do not substitute a general marketing claim for a plan-specific answer.
- Test the result: Look for mixed-content warnings, test forms, and check that internal links and canonical URLs use the HTTPS address. Write down what this means for your own website, identify the information you still need, and verify it using your current account or the relevant provider’s documentation. Do not substitute a general marketing claim for a plan-specific answer.
If an answer is uncertain, pause that part of the decision and verify it. For changes to a live site, make a restorable backup first and test the result before deleting the previous configuration.