Installing an SSL/TLS certificate is only one part of moving WordPress to HTTPS. The certificate must cover the hostname visitors use and be active where TLS ends; WordPress must store the correct https:// URLs; old database values and theme or plugin assets must stop requesting http://; and any proxy, CDN, web server, and WordPress redirect rules must agree about whether a request is secure. A failure at any one of those layers can leave a missing padlock, mixed-content warnings, or a “too many redirects” error.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What HTTPS changes—and what installing a certificate does not
HTTPS encrypts the connection between a visitor and the system that terminates TLS. WordPress describes itself as fully compatible with HTTPS when a TLS/SSL certificate is installed and available for the web server to use. Installing that certificate, however, does not rewrite WordPress’s stored site URLs, repair old links in post content, or change URLs generated by a theme or plugin.
As an Amazon Associate I earn from qualifying purchases.
Think of the migration as four separate checks:
- Certificate and hostname: the certificate must be valid for the exact apex or
wwwhostname being visited, have a valid chain, be unexpired, and be installed at the server or proxy that terminates TLS. - WordPress URL configuration: the WordPress Address and Site Address must use the final canonical HTTPS hostname.
- Resource URLs: images, scripts, stylesheets, embeds, and other assets on each page must also load over HTTPS.
- Request detection and redirects: a proxy, origin server, and WordPress must agree on whether the original request was HTTPS and which hostname is canonical.
Diagnose those layers in that order. Fixing a later layer cannot compensate for a certificate that is missing or issued for a different hostname.
1. Confirm the certificate and the hostname first
Open the exact HTTPS address
Visit the URL that produces the warning, including its hostname and path, and inspect the browser’s certificate details. Check that:
- the certificate includes the exact hostname, such as the apex domain or its
wwwvariant; - the certificate is within its validity period;
- the certificate chain is trusted and complete; and
- the certificate is installed on the server or reverse proxy that actually handles the HTTPS connection.
A certificate for www.example.test does not automatically cover example.test, and a certificate installed only on an origin server is irrelevant if a proxy terminates TLS before the request reaches that origin. Test every hostname you intend to support rather than assuming one successful address proves the others work.
Handle a certificate that is still pending
If a hosting dashboard reports “SSL certificate pending,” the certificate may not have been issued or deployed yet. Check DNS before repeatedly requesting issuance. WordPress.com documents that a DNS CAA record can prevent Let’s Encrypt from issuing a certificate. Correct the DNS policy or wait for propagation and provisioning, then inspect the certificate again at the public HTTPS endpoint. A pending status is a certificate-provisioning problem, not a mixed-content problem inside WordPress.
2. Align WordPress’s two canonical URLs
Change both fields in Settings → General
In the WordPress administration area, open Settings → General. Set both WordPress Address (URL) and Site Address (URL) to the same intended HTTPS hostname, for example https://example.test. Use the hostname you selected as canonical; do not leave one field on HTTP or point one field at www while the other uses the apex domain unless that split is deliberate and supported by your server configuration.
Save the change, sign out, and test both the front end and /wp-admin/. If the fields are unavailable, immediately revert to HTTP, or keep returning to their old values, a configuration constant or database value is overriding the form.
Check wp-config.php when the fields are locked
Look for hard-coded WP_HOME and WP_SITEURL constants in wp-config.php. If present, make them match the final canonical HTTPS hostname exactly, including the choice between apex and www. A constant takes precedence over the General Settings fields, so changing the fields alone will not solve a mismatch created in this file.
Keep a recovery route before editing configuration. File access or database access is useful if an incorrect URL prevents the dashboard from loading. Do not add FORCE_SSL_ADMIN as a substitute for correcting these base URLs; administrator SSL assumes the server’s SSL virtual host is already working.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →3. Migrate old HTTP values safely
Back up before searching and replacing
WordPress core guidance identifies hard-coded HTTP URLs in existing database content as a major source of mixed-content warnings. Before replacing anything, make a complete database backup and record the current site and home URLs. A global text replacement can damage serialized data if it is performed without a serialization-aware migration method, so use a tool or procedure that understands serialized WordPress values.
Search for the old http:// form of your exact hostname in ordinary content and settings. Include post bodies, page builders, widget settings, navigation or custom-field values, and theme or plugin options. Replace only the old site URL with the matching HTTPS URL; do not blindly convert every external HTTP address, because some third-party endpoints may not support HTTPS or may require a different canonical URL.
Rank #3
- 【Tired of constantly searching for or resetting your passwords?】 MOSA BEAR password keeper book is the perfect solution for you! This password book provides a dedicated place to securely store all your important website addresses, emails, usernames and passwords, ensuring your information is protected and easy to find. The well-designed log pages help you manage multiple accounts in a systematic way, saying goodbye to password confusion.
- 【Premium Design & Password Security】 The password book with alphabetical tabs features an anonymous cover design with no title on the cover, effectively avoiding information exposure. The password keeper design is specifically designed with password security in mind, providing space to record password hints instead of writing directly on the password itself, further protecting your important information.
- 【Simple Layout and Plenty of Space】The 160-page password logbook is designed to provide ample space to record passwords and other important information. It can store up to 414 passwords. In addition, it provides extra pages to record other information, such as email setup, card information, computer operating system information, software licenses, and more. The journal also includes 3 blank pages at the end for you to add additional notes.
- 【Palm-sized Size & Premium Quality】 This password notebook has an ideal size, 4.3" x 5.7", for carrying around, whether in a purse or pocket. Its sturdy glue binding allows the notebook to unfold smoothly and is more comfortable to use. The inner pages are made of high-quality 100GSM thick paper, which can effectively reduce ink penetration and ensure a cleaner and neater writing effect. The overall design takes into account both portability and durability, making it an ideal choice for recording important passwords.
- 【A-Z Tabs for Quick Search 】Our password book comes with alphabetical tabs to help you find the password you need quickly and easily. Alphabetically organized tabs ensure that you can quickly flip to the right section, saving you the time and hassle of searching for your password.
Check generated links after the migration
Clear any page cache and test representative pages while logged out. Check the home page, a post containing images, a page using a form or embedded media, and a page that loads plugin or theme features. If a link still appears as HTTP, identify where it originates instead of repeating the database replacement: it may be hard-coded in a template, generated by a plugin, or supplied by an external embed.
4. Diagnose and remove mixed content
Understand why the padlock can be missing on only some pages
Mixed content is a resource-level problem. The document itself is delivered over HTTPS, but one or more resources are requested over HTTP. Typical offenders are old image URLs, theme CSS or JavaScript, plugin assets, embedded media, and third-party scripts. Because resources differ by page, one page can show a padlock while another displays a warning.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUse the browser to find the exact request
- Open the affected page in a private or clean browser session.
- Open the browser developer tools and select the Console and Network panels.
- Reload the page and locate warnings or requests beginning with
http://. - Record the full URL and the file or setting that generated it. View the page source as well when a request is created in the initial HTML.
The URL tells you which layer to edit. An image URL in post content belongs in the post or database migration; a stylesheet or script URL belongs to the theme or plugin; an embed may need to be changed in the editor; and a third-party script may require an HTTPS endpoint from its provider. Reinstalling the certificate does not alter any of those references.
Fix the source, not just the symptom
Update the originating setting, template, plugin option, or database value to HTTPS, then purge caches and reload the page. Test both logged-out pages and wp-admin, because administrator screens can load different scripts and may reveal a separate HTTP reference. If a third-party resource has no HTTPS equivalent, remove it or replace it with a secure source; leaving it in place can continue to trigger browser warnings even when every first-party URL is correct.
Rank #4
- Bookbound planner helps you keep track of passwords and favorite websites
- Room for over 200 entries; 3.5 x 6 inch page sizes
- User name and security questions field
- Tips for what makes a strong password; web resources; notes pages
- Printed on quality paper containing 30% post-consumer waste; black simulated leather cover; 3.63 x 6.13 x .21 inches
5. Stop “too many redirects” errors
Identify which layers are redirecting
A redirect loop means that layers disagree about the request’s scheme or hostname. Common patterns include an origin that redirects HTTP to HTTPS while a proxy tells the origin the request was HTTP, or a chain that alternates between the apex and www hostnames. WordPress warns that forcing HTTPS behind a reverse proxy that provides SSL while the origin itself runs without SSL can initially create an infinite loop.
Temporarily disable nonessential redirect rules and test the chain from a clean browser session. Check the response sequence for each combination of:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallhttp://with the apex hostname;http://with thewwwhostname;https://with the apex hostname; andhttps://with thewwwhostname.
Choose one canonical HTTPS hostname and make every other combination redirect to it once. Avoid having separate, competing rules in the proxy, web server, and WordPress when one authoritative layer can perform the redirect.
Make HTTPS detection work through a proxy
When TLS terminates at a reverse proxy, the origin may receive an ordinary HTTP connection even though the visitor connected over HTTPS. The proxy must send a forwarded-protocol value, commonly HTTP_X_FORWARDED_PROTO: https or the platform’s equivalent. WordPress’s is_ssl() reference warns that HTTPS detection can fail behind some load balancers and documents using the forwarded-proto condition.
Configure WordPress to recognize that trusted header before forcing HTTPS or administrator SSL. The exact implementation depends on your hosting stack, but the principle is constant: trust the header only from the proxy that controls it, and make the proxy, origin, and WordPress agree on the same scheme. If the origin is supposed to handle TLS itself, install the certificate there instead of applying a proxy-only assumption.
Simplify www and non-www redirects
Decide whether the apex or www hostname is canonical. Set both WordPress URL fields and any WP_HOME or WP_SITEURL constants to that choice. Then inspect server and proxy rules for a second hostname redirect. A request should not bounce from HTTPS apex to HTTP www, then back to HTTPS apex. Test after clearing browser HSTS or cached redirects when necessary, because a browser can retain an earlier redirect while you are correcting the server.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Keep administrator SSL aligned with the front end
FORCE_SSL_ADMIN belongs in wp-config.php, not in a plugin file, and it assumes the server’s SSL virtual host is already configured. Enable it only after the public HTTPS URL, proxy detection, and canonical hostname work consistently.
If enabling it locks you out of wp-admin, use file or database access to correct the proxy HTTPS detection and URL constants, then temporarily remove or disable the setting. Restore administrator SSL after the origin and proxy chain report the same scheme. Do not repeatedly toggle the setting while the underlying forwarded-proto or hostname mismatch remains; each toggle can obscure the original fault.
Match the symptom to the failing layer
| Axis | What to compare | Typical remedy |
|---|---|---|
| Certificate and hostname | Validity, expiry, chain, exact hostname, provisioning state | Hosting, DNS, or certificate correction |
| TLS termination | Origin server versus CDN or reverse proxy | Forwarded-proto configuration and one consistent redirect policy |
| URL consistency | WordPress Address, Site Address, WP_HOME, WP_SITEURL, and database URLs |
Settings correction and careful search/replace |
| Resource behavior | HTTP assets, redirects, and canonical www choice | Update asset origins and simplify redirect rules |
Final verification checklist
Run this checklist after each layer change rather than changing everything at once:
- Open the exact HTTPS apex and
wwwaddresses and inspect the certificate for hostname coverage, chain, and expiry. - Confirm that both WordPress URL fields, and any URL constants, use the chosen canonical HTTPS hostname.
- Back up the database, migrate old first-party HTTP URLs with a serialization-aware method, and clear caches.
- Use developer tools on several pages to find and remove every remaining HTTP image, stylesheet, script, embed, or plugin asset.
- Test all four HTTP/HTTPS and apex/
wwwcombinations in a clean session and verify that each reaches the canonical HTTPS URL without a loop. - If TLS ends at a proxy, verify that the origin receives the forwarded HTTPS indication and that WordPress recognizes it.
- Test the front end and
wp-adminwhile logged out and logged in before re-enabling administrator SSL enforcement.
When these checks pass, the padlock, secure administrator access, and stable redirects are outcomes of a consistent certificate, URL, resource, and proxy configuration—not of the certificate installation alone.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
