Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Move a WordPress site to HTTPS in this order: back up the files and database, install and test a TLS certificate, change WordPress’s WordPress Address (URL) and Site Address (URL), replace stored HTTP links, remove mixed content, redirect every HTTP URL to its HTTPS equivalent, then verify SEO and site functionality. Changing the two URL fields alone does not update links stored in posts, widgets, themes, plugins, or external services.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Keep the old HTTP host available for redirects, and do not switch the WordPress URLs until an HTTPS request already loads the site successfully. A staged, reversible migration prevents the most damaging outcomes: a locked-out administrator, redirect loops, broken media, blocked scripts, and duplicate HTTP/HTTPS pages in search results.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What changes when a WordPress site moves to HTTPS
HTTP and HTTPS are different URL schemes. Search engines, browsers, caches, cookies, APIs, and external services can treat http://example.com and https://example.com as different addresses even when they point to the same server. The migration therefore has three separate parts:
- TLS at the server or edge: a valid certificate and an HTTPS listener must serve the domain.
- WordPress’s canonical settings: the
homeandsiteurlvalues must use HTTPS. - Every reference to the old origin: links, media URLs, scripts, stylesheets, fonts, forms, feeds, sitemaps, API endpoints, and redirects must be made consistent.
WordPress is fully compatible with HTTPS when a TLS/SSL certificate is installed and available for the web server. HTTPS protects the connection between visitors and the endpoint that terminates TLS; it does not automatically repair insecure URLs embedded in your content or third-party services.
Before you start: requirements and a rollback plan
Schedule the change when you can monitor the site. You need administrator or server access, access to your DNS or CDN settings if TLS terminates away from the origin, and a way to edit the database or run WP-CLI. Record the current values of both WordPress URLs, the active theme and plugins, the web-server configuration, cron jobs, webhook endpoints, and any payment or authentication integrations.
Make two independent backups
- Download a complete copy of the WordPress files, including
wp-content, uploads, themes, plugins, and configuration files. - Export the entire WordPress database, not just the posts table.
- Store both backups outside the live document root and, preferably, in a separate storage location. Confirm that the database dump can be opened and that the file archive contains the expected uploads.
- Write down the backup timestamp and the exact HTTP URLs so you can restore the pre-migration state if necessary.
Do not rely on a backup created after changing the URL fields. A rollback is useful only if it contains the old database values and the old server configuration.
Install and verify TLS before changing WordPress
Obtain a certificate that covers every hostname visitors use, such as the apex domain and the www hostname when both are public. Install it where HTTPS terminates and configure the secure virtual host, load balancer, CDN, or reverse proxy. Set the certificate renewal process before the migration; an expired certificate can make the entire site unreachable even though WordPress itself is healthy.
Choose where HTTPS terminates
| Termination point | What you configure | Important check |
|---|---|---|
| Origin web server | Certificate, private key, HTTPS virtual host, and port 443 | The origin serves the correct certificate and WordPress receives an HTTPS request. |
| CDN or edge network | Certificate and HTTPS mode at the edge, plus the edge-to-origin connection | Decide whether the origin connection is also encrypted; do not let the edge tell WordPress the request is HTTP when the visitor used HTTPS. |
| Reverse proxy or load balancer | Certificate and a forwarded-protocol header such as X-Forwarded-Proto |
Configure WordPress and the server to trust the proxy’s HTTPS indication, otherwise redirects can loop. |
Open the HTTPS version of the homepage, an ordinary post, an image URL, and the login page before touching WordPress settings. Check that the certificate matches the hostname, is not expired, and presents a complete chain in a normal browser. If HTTPS does not work at this stage, fix DNS, the certificate, or the virtual host first.
Change the WordPress Address and Site Address
Use the WordPress dashboard
- Sign in to WordPress.
- Go to Settings → General.
- Change WordPress Address (URL) to the HTTPS origin.
- Change Site Address (URL) to the same HTTPS origin unless your installation deliberately separates the core files from the public site.
- Remove a trailing slash from both values. For example, use
https://example.com, nothttps://example.com/. - Save the changes, then sign in again at the HTTPS login URL.
Both fields must use the same hostname and scheme that visitors should regard as canonical. If one remains HTTP, WordPress can generate a mixture of secure and insecure links or redirect users between schemes.
When constants control the URLs
If WP_HOME or WP_SITEURL is defined in wp-config.php, the dashboard values may be unavailable or may appear to change back. Update the constants instead:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');Do not set conflicting values in both the file and the database. Use one authoritative configuration and keep the same no-trailing-slash format.
Emergency changes when the dashboard is inaccessible
If the URL change has locked you out, temporarily define the correct constants in wp-config.php or update the home and siteurl options in the database with a backup-aware administration tool. Restore normal configuration after access returns. Do not repeatedly edit values without first identifying whether the database, constants, or a proxy is providing the conflicting scheme.
Replace old HTTP URLs without corrupting data
Changing the two options does not rewrite URLs already stored in post content, page-builder data, widgets, custom fields, theme files, plugin settings, menus, feeds, or serialized option values. Search for the exact old origin, including alternate hostnames such as http://www.example.com if that variant was used.
Use a serialization-aware search and replace
Run the replacement on a staging copy or after taking a fresh database backup. A serialization-aware WordPress tool or WP-CLI updates serialized lengths correctly; a raw SQL replacement can make widgets, settings, or page-builder layouts unreadable.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWith WP-CLI, first preview the operation:
wp search-replace 'http://example.com' 'https://example.com' --all-tables-with-prefix --precise --recurse-objects --dry-runReview the table and column counts. If the matches are appropriate, run the same command without --dry-run:
wp search-replace 'http://example.com' 'https://example.com' --all-tables-with-prefix --precise --recurse-objectsInclude custom tables only when you understand their schema. Treat values such as historical GUIDs cautiously; do not alter identifiers merely because they contain the old scheme unless your migration policy specifically requires it.
Search places outside the main post tables
- Theme PHP, CSS, and JavaScript files containing hard-coded origins.
- Widget text, navigation menus, reusable blocks, and custom fields.
- Plugin settings, page-builder data, and form actions.
- Image, video, audio, font, iframe, and API URLs in post content.
- Server-side configuration, cron scripts, deployment files, and environment variables.
- External systems such as email templates, webhooks, payment callbacks, and OAuth redirect URLs.
After replacement, search again for http://. Exclude deliberately external HTTP resources only after verifying that the provider does not offer HTTPS; an insecure third-party dependency can still create mixed content or fail in modern browsers.
Find and fix mixed content
Mixed content occurs when an HTTPS document requests an HTTP resource. Browsers may warn about passive media and block active resources. Active examples include JavaScript, CSS, fonts, iframes, API calls, and form submissions; a blocked stylesheet can make the site appear unstyled, while a blocked script can disable menus, checkout, or login features.
Use the browser to identify the exact URL
- Open a representative page in a private browser window.
- Open developer tools and select the Console and Network panels.
- Reload the page and filter requests for
http://, “mixed content,” or blocked status messages. - Record the requesting file or plugin and the full insecure URL.
- Replace the reference in WordPress content, the theme or plugin setting, or the external provider. Clear caches and reload to confirm the request is now HTTPS.
Do not solve mixed content by blindly forcing every URL through a rewrite rule. A resource that has no HTTPS endpoint may need to be removed, self-hosted, or replaced. Protocol-relative URLs such as //cdn.example.com/file.js inherit the page scheme, but an explicit HTTPS URL is clearer when the provider supports it.
Redirect every HTTP URL to its HTTPS equivalent
Keep the HTTP endpoint active solely to issue a permanent redirect. Each old path must map to the same path and preserve the query string: http://example.com/game/?p=42 should become https://example.com/game/?p=42, not merely the homepage. Redirect at the web server or edge layer before WordPress handles the request when possible.
Apache example
In the HTTP virtual host, or in the appropriate configuration layer, use a single redirect rule:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,NE]Use the canonical hostname explicitly if you also need to consolidate www and the apex domain. Test the rule in staging first; an incorrect condition behind a proxy can redirect an already secure request back to itself.
Recommended Free Tools
Rank #3
Nginx example
server {
listen 80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}This preserves the requested path and query string while choosing example.com as the canonical host. Configure the HTTPS server separately and make sure its certificate covers every hostname that can reach it.
Test redirects for chains and loops
Run a header request for the homepage, a deep post URL, a media URL, and a URL with query parameters:
curl -I http://example.com/sample/?ref=test
curl -I -L http://example.com/sample/?ref=testThe first response should be a single permanent redirect to the matching HTTPS URL. The followed request should end with a successful HTTPS response, not a chain through several temporary URLs or an “unable to redirect” loop. Keep HTTP redirects working for old bookmarks and links; removing the old endpoint too early strands visitors and search crawlers.
Prevent reverse-proxy redirect loops
When TLS ends at a proxy, the origin may see an ordinary HTTP connection even though the visitor used HTTPS. Configure the proxy to forward the original protocol and configure WordPress or the server to trust that header only from the known proxy. WordPress specifically warns that mismatched proxy and origin SSL settings can produce infinite redirects. Never trust an arbitrary client-supplied forwarded-protocol header.
Make SEO signals consistent after the move
Google treats a protocol change as a site move. Redirects transfer users and crawler requests, but the rest of the site must also identify HTTPS as canonical.
- Set canonical tags to HTTPS.
- Update internal links, navigation, image links, feeds, and downloadable assets.
- Generate an HTTPS XML sitemap and ensure
robots.txtreferences that sitemap. - Change hreflang URLs and structured-data fields, such as image, video, and organization URLs, to HTTPS.
- Update profile links, analytics settings, webhook endpoints, and any external service that records the site URL.
- Add and verify both HTTP and HTTPS properties in Google Search Console. Inspect representative HTTPS URLs and monitor indexing, redirect, and “Not found” reports.
Crawling can temporarily increase during a site move. Monitor server capacity and error logs rather than interpreting the initial crawl spike as a ranking change. A protocol migration has no guaranteed ranking benefit by itself; its search outcome depends on complete redirects, accessible content, and consistent canonical signals.
What WordPress 5.7 and newer can do automatically
WordPress 5.7 introduced improved HTTPS detection and migration support. When WordPress recognizes that the site is HTTPS and the domains match, core can replace insecure home URLs in some frontend output. This is a safety net for certain legacy references, not proof that every stored value has been migrated.
Core cannot reliably repair arbitrary plugin data, theme code, external embeds, CSS, JavaScript, database fields, or third-party API endpoints. Continue with a database search, source inspection, and live functional tests even when the homepage appears to have no warning.
Test the live site systematically
Use an incognito session for anonymous behavior and a separate logged-in session for administration. Check more than the homepage:
| Area | Test | Failure to investigate |
|---|---|---|
| Authentication | Log in, log out, reset a password, and verify secure cookies. | Login loops, lost sessions, or cookies scoped to the HTTP host. |
| Content and media | Open posts, archives, search results, galleries, video, and downloadable files. | Broken images, blocked media, or links that still begin with HTTP. |
| Forms and commerce | Submit contact forms and test checkout or account flows in the appropriate sandbox. | Insecure form actions, blocked scripts, failed payment callbacks, or duplicate submissions. |
| APIs and integrations | Exercise REST endpoints, webhooks, embeds, mobile-app calls, and OAuth callbacks. | Certificate errors, rejected callback URLs, CORS failures, or stale HTTP endpoints. |
| Crawling | Open robots.txt, sitemap.xml, canonical tags, and feeds. |
HTTP references, inaccessible files, or a sitemap that lists the old scheme. |
| Operations | Run cron jobs, queued tasks, backups, cache purges, and certificate-renewal checks. | Jobs calling old URLs or renewal failures that will cause a later outage. |
Inspect web-server and PHP logs for 301 chains, 302 responses that should be permanent, 404 errors, TLS handshake failures, and repeated requests to HTTP assets. Test from outside your office network so local DNS or cached certificates do not hide a public problem.
Common failure modes and targeted fixes
The dashboard redirects endlessly
Check whether the proxy forwards the original HTTPS protocol and whether WordPress is configured to recognize it. Remove conflicting WP_HOME, WP_SITEURL, database, and server rules, then test one canonical hostname.
The site loads but looks broken
Use the console to find blocked CSS, JavaScript, fonts, or iframe requests. Update the stored URL or plugin setting that generated each request, purge page and CDN caches, and reload with developer tools open.
Images still use HTTP
Search attachment metadata, post content, custom fields, CSS backgrounds, and page-builder data. Run a serialization-safe replacement for the exact old origin and inspect image URLs generated by responsive-image or gallery plugins.
Some old URLs return 404
Compare the HTTP path and query string with the redirect target. Fix host-specific rules that drop the path, restore missing rewrite rules, and inspect Search Console’s “Not found” report for patterns introduced during the move.
Only logged-in users see errors
Test administrator pages, authenticated REST requests, nonce-protected forms, and secure-cookie settings. A plugin may have a hard-coded callback or API origin that anonymous pages never call.
How to choose an implementation approach
| Approach | Best fit | Trade-offs to verify |
|---|---|---|
| Origin-managed TLS | A site owner who controls the web server and wants one direct configuration. | You own certificate issuance, renewal, firewall rules, and redirect testing at the origin. |
| CDN or edge-managed TLS | A site already using an edge service for caching or traffic protection. | Confirm edge-to-origin encryption, forwarded-protocol handling, cache purges, and where redirects are evaluated. |
| Reverse-proxy or load-balancer TLS | Multi-server or containerized WordPress installations. | All backends must agree on the canonical scheme, trusted proxy headers, health checks, and renewal ownership. |
| Dashboard-only URL change | Only a temporary diagnostic in a disposable environment. | It does not replace database search-and-replace, redirects, mixed-content cleanup, or SEO verification. |
Whichever architecture you use, document who renews the certificate, who controls redirects, how staging is tested, and how to restore the backup. The safest process is the one that makes those responsibilities explicit.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rollback if the migration fails
- Stop making additional database replacements.
- Keep a maintenance notice ready if transactions or user submissions could be lost.
- Restore the pre-migration database and files, or revert the specific URL changes from your verified backup.
- Restore the previous web-server, proxy, and CDN configuration.
- Confirm the old HTTP site works, then diagnose the failed stage in a staging copy.
- Repeat the migration only after fixing the certificate, proxy protocol, redirect, or data-replacement problem that caused the failure.
Do not delete the HTTP site during rollback or migration. Its redirect role is part of the move and is also how old links continue to reach the secure URLs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
