Originally published: May 27, 2021 · Last updated: August 13, 2026
Moving a WordPress site from HTTP to HTTPS is much easier than it used to be, but an established site still needs a controlled migration. HTTPS protects traffic between visitors and the server, and modern browsers expect production websites to use it consistently.
Start with a valid certificate
Before changing WordPress, confirm that the HTTPS version of the domain loads without a certificate warning. Most modern hosting providers can issue and renew certificates automatically.
Take a fresh backup before changing an established site’s URLs. The main risks are usually not the certificate itself, but old absolute links, mixed content, caches and third-party integrations.
Update the WordPress site addresses
WordPress includes native support for switching site URLs to HTTPS when the server environment is ready. On a standard installation, check the WordPress Address and Site Address under Settings → General. Both should use HTTPS when the site is intended to run entirely over HTTPS.
If those settings are managed by the hosting platform or configuration files, use the host’s supported migration method instead of forcing a second method on top of it.
Redirect the old HTTP URLs
After the HTTPS version works, visitors and crawlers should reach a single canonical version of each page. Configure a permanent redirect from each HTTP URL to its HTTPS equivalent. Many managed hosts provide this as a simple setting.
Test several internal pages after enabling the redirect, not just the homepage. A clean migration should avoid unnecessary redirect chains.
Fix mixed content
A page can load over HTTPS while still requesting an image, stylesheet, script or embed over HTTP. Browsers call this mixed content and may block insecure resources.
Use the browser developer console and a site crawler to identify remaining HTTP resources. Correct the original URLs where possible. If many legacy URLs are stored inside WordPress, use a WordPress-aware migration tool rather than manually editing database data.
Clear caches and test the site
After the switch, clear the relevant WordPress, hosting and CDN caches. Then test login, forms, embedded media and any checkout or account areas. Old cached HTML is a common reason mixed-content warnings appear to persist after the underlying URLs have already been corrected.
Review connected services
Some external services may still store the old HTTP address. Check analytics, CDN settings, webhooks, authentication callbacks, email templates and other integrations that depend on the exact site URL.
SEO checks after the migration
Keep the same URL paths whenever possible and redirect each HTTP page directly to its HTTPS counterpart. Verify that canonical tags and the XML sitemap use HTTPS, then monitor Search Console for crawling or indexing anomalies.
HTTPS migration checklist
- Confirm that the certificate is valid.
- Back up the site.
- Change the WordPress site addresses to HTTPS using the supported method.
- Enable permanent HTTP-to-HTTPS redirects.
- Clear caches.
- Find and fix mixed-content resources.
- Test forms and integrations.
- Verify the sitemap, canonicals and Search Console.
Official references: WordPress HTTPS improvements and MDN mixed content guidance.