Recommended Free Tools
To enable HTTPS with your own certificate, install the certificate, matching private key, and any required intermediate chain on the server, proxy, load balancer, or hosting panel that terminates TLS. Then point WordPress at the HTTPS URL, configure proxy headers when TLS ends elsewhere, and test before forcing secure administration. WordPress itself does not upload or activate certificates.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What you are actually configuring
SSL is the older name commonly used for the technology now implemented as TLS. A browser establishes the encrypted connection with the web server or reverse proxy; WordPress runs behind that connection and generates links, cookies, redirects, and admin URLs based on the request information it receives.
As an Amazon Associate I earn from qualifying purchases.
WordPress is HTTPS-compatible when a TLS certificate is installed and available for the web server to use. The certificate is therefore not uploaded in the WordPress dashboard. The certificate, private key, and intermediate chain belong on the TLS terminator: Apache, Nginx, a load balancer, a CDN, or a hosting control panel.
- The certificate must cover every public hostname that visitors use, such as the chosen www or non-www name.
- The private key must be the key that was generated for and matches the certificate.
- The intermediate certificates supplied by the issuer may be needed to build a complete chain for browsers.
- Private-key files must remain outside the public document root and readable only by the service account or administrators who need them.
Before you change WordPress
Inventory the HTTPS endpoint
Identify exactly where port 443 is terminated. In a simple installation, Apache or Nginx handles TLS directly. In a managed deployment, a load balancer, CDN, ingress controller, or hosting panel may handle it and forward ordinary HTTP to the WordPress server. Install the custom credentials at that endpoint, not in the WordPress files.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Confirm the certificate set
Have these items ready:
- The certificate for the public hostname, commonly supplied as a PEM or CRT file.
- The matching private key, commonly supplied as a KEY file.
- The issuer’s intermediate certificate or full-chain file, when required.
- Administrative access to validate and reload the TLS terminator.
- A recovery route, such as SSH, a hosting console, or database access, in case changing URLs prevents dashboard access.
Check the certificate’s subject or Subject Alternative Names against the exact hostname in the browser address bar. A certificate for one name does not automatically cover another name, even when both point to the same server.
Install a custom certificate on Apache
Copy the certificate and key to protected locations outside the public document root. The HTTPS virtual host must reference both files. A minimal Apache virtual host is:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →<VirtualHost *:443>
ServerName example.com
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/example.crt
SSLCertificateKeyFile /etc/apache2/ssl/example.key
DocumentRoot /var/www/example
</VirtualHost>Use your operating system’s certificate-chain directive or a bundled full-chain file when the issuer supplied intermediates. The exact directive and file layout differ among Apache distributions, so retain the convention used by your platform rather than copying a path blindly.
- Place the certificate, key, and chain with restrictive ownership and permissions. The web server must be able to read the key, but browsers and ordinary site visitors must not.
- Enable the SSL module and the HTTPS virtual host if your distribution requires those steps.
- Run Apache’s configuration-test command for your operating system. Do not reload a configuration that reports syntax, file-permission, or certificate errors.
- Reload Apache using the service manager supplied by your operating system.
- Connect to the public hostname and inspect the certificate presented on port 443. Confirm that the expected certificate, hostname, validity period, and chain are shown.
If Apache starts but presents a different certificate, check which virtual host is selected for the hostname and whether another default HTTPS virtual host is taking precedence.
Install a custom certificate on Nginx
In Nginx, place the certificate and key in protected files and reference them in the TLS-enabled server block. The relevant directives are ssl_certificate and ssl_certificate_key. The certificate file normally contains the server certificate followed by the required intermediate certificates in the order specified by your issuer.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/ssl/example-fullchain.crt;
ssl_certificate_key /etc/nginx/ssl/example.key;
root /var/www/example;
index index.php index.html;
}- Verify that the certificate file and key are readable by Nginx but not publicly downloadable.
- Run Nginx’s configuration test, commonly the command supplied by your distribution, and correct every reported error.
- Reload Nginx without stopping the service when the test succeeds.
- Open the public hostname over HTTPS and verify the presented certificate and chain.
A key mismatch, an incomplete chain, or a certificate assigned to the wrong server_name can all make a technically running Nginx instance appear broken to browsers.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use a hosting panel, load balancer, or CDN
When a managed interface terminates TLS, use its certificate-binding screen rather than editing WordPress. Upload the certificate, private key, and intermediate certificate in the fields provided, then bind them to the exact public hostname. Some interfaces expect a full-chain certificate in one field; others provide a separate chain field.
After saving, verify that the endpoint is serving the custom certificate. Also record how renewal and rollback work. A panel may replace the certificate during an automated renewal, while a load balancer may require the new credential to be attached to one or more listeners or target groups.
Set WordPress to its canonical HTTPS URLs
Once the HTTPS virtual host responds correctly, change both WordPress URL values to the same canonical origin. Use the dashboard when it remains reachable:
- Sign in to Settings and open General.
- Change WordPress Address (URL) to
https://example.com. - Change Site Address (URL) to
https://example.com. - Omit the trailing slash and save the settings.
WP_SITEURL is the location of the WordPress core files, while WP_HOME is the public address visitors use. They are often identical, but a deliberately separate core directory is a valid reason for them to differ.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
If the dashboard is inaccessible, temporarily define the values in wp-config.php before the line that says That's all, stop editing!:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );These constants override the stored home and siteurl options while they are present. Removing them exposes the old database values again, so update the database through the dashboard or a controlled migration if you want the HTTPS values to remain after the constants are removed.
Force secure logins and administration
After the HTTPS endpoint and WordPress URLs work, force login and administration requests over HTTPS by adding this constant to wp-config.php:
define( 'FORCE_SSL_ADMIN', true );This setting belongs in wp-config.php, not only in a plugin. The secure virtual host must already be functioning before you enable it. The older FORCE_SSL_LOGIN constant is deprecated and should not be used for a new configuration.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallConfigure WordPress behind a reverse proxy
A common architecture terminates TLS at a load balancer, CDN, or Nginx proxy and forwards plain HTTP to PHP or Apache. In that arrangement the browser is using HTTPS, but the backend connection is not. Unless the proxy communicates the original protocol and host, WordPress may believe the request is HTTP and generate insecure URLs or redirect endlessly.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Send the original host and protocol
A representative Nginx proxy location is:
location / {
proxy_pass http://wordpress_backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
}The equivalent settings on another proxy should preserve the public host and indicate whether the original client connection used HTTPS. Header names and configuration syntax vary, but the information must reach the WordPress process.
Tell WordPress when the forwarded request was HTTPS
In wp-config.php, use the documented pattern when the forwarded protocol contains HTTPS:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
&& strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
$_SERVER['HTTPS'] = 'on';
}Trust this header only when it is inserted or sanitized by a proxy you control. If clients can send it directly to the backend, they could spoof the value and bypass assumptions made by application code.
Correct a substituted host name
Some proxies send an internal backend host in Host while placing the public name in X-Forwarded-Host. WordPress must use the validated public host for canonical URLs. Set $_SERVER['HTTP_HOST'] from the validated forwarded host or an appropriate server-name value for your infrastructure, and reject unexpected hostnames at the proxy. Do not copy a host header from an untrusted client without an allow-list.
Check pages, assets, and redirects
Test the site as a visitor and as an administrator. Check the HTTPS home page, a representative post, a media attachment, a stylesheet, the login page, and several wp-admin screens.
- The certificate hostname and chain validate without browser warnings.
- An HTTP request redirects once to the chosen HTTPS origin rather than bouncing between HTTP and HTTPS.
- Links, forms, canonical tags, feeds, and sitemaps use the intended HTTPS hostname.
- Scripts, styles, images, fonts, video, and embedded frames are not loaded over HTTP.
- Login cookies are issued securely and remain usable across the front end and dashboard.
A page that redirects repeatedly usually means WordPress sees backend HTTP while HTTPS URLs or FORCE_SSL_ADMIN are enabled. A broken layout with no redirect loop usually points to old absolute http:// URLs in post content, theme settings, widgets, or plugin data.
Replace old HTTP URLs safely
Make a database backup before changing stored URLs. WordPress data often contains serialized PHP values; a blind SQL string replacement can change string lengths and corrupt those values.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Back up the database and confirm that the backup can be restored.
- Use a WordPress-aware serialized-data migration tool or a plugin designed to preserve serialized values.
- Replace only the old origin, such as
http://example.com, with the exact HTTPS origin. Avoid changing unrelated text or third-party URLs. - Clear page caches, object caches, and CDN caches after the replacement.
- Repeat the asset and redirect checks in a private browser session.
Mixed-content warnings can also come from a plugin option, a hard-coded theme file, a stylesheet, or an external service that still publishes an HTTP URL. Fix the source rather than hiding the warning with a browser-side workaround.
Choose the TLS termination model
| Deployment | Who controls TLS | Custom certificate and key | Operational checks | Main risk |
|---|---|---|---|---|
| Apache on the WordPress server | Server administrator | Direct file placement and virtual-host directives | Local configuration test, service reload, direct certificate inspection | Incorrect virtual-host selection or key permissions |
| Nginx on the WordPress server | Server administrator | Direct file placement and ssl_certificate directives |
Local configuration test, reload, certificate inspection | Wrong server block or incomplete full chain |
| Managed hosting panel | Hosting provider’s interface | Supported only if the panel exposes upload fields for certificate, key, and chain | Panel validation and hostname binding | Limited rollback or provider-specific renewal behavior |
| Load balancer or CDN | Proxy operator | Uploaded to the listener or edge certificate store when supported | Listener validation plus forwarded-host and forwarded-protocol checks | Redirect loops or host spoofing if headers are mishandled |
Before choosing an implementation, confirm who can access the TLS terminator, whether customer-supplied credentials are accepted, how forwarded headers are validated, whether you can run configuration tests and reloads, how to regain access after a URL mistake, and how certificates are renewed.
Renewal, rotation, and private-key security
Plan renewal before expiry
Record the certificate’s expiration date and the procedure for replacing it. A renewal may produce a new certificate for the same key or a new certificate and key pair. Upload the complete chain, bind the replacement to every relevant listener, reload the terminator, and verify the public endpoint before removing the previous credential.
Protect and rotate the key
Treat the private key as a secret equivalent to a server credential. Never paste it into a public WordPress page, a support ticket, a theme file, or a plugin setting that does not explicitly require secure key storage. If the key is exposed, revoke the certificate through its issuer, generate a replacement key and certificate, deploy the replacement, and remove the compromised key from every system.
Keep a rollback path
Retain a tested backup of the previous server configuration and know how to disable a bad URL constant. If a URL change locks out wp-admin, use the recovery console or edit wp-config.php to restore temporary access, correct the database values, and then remove temporary overrides.
Troubleshooting by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| Browser reports a hostname mismatch | The certificate does not include the public hostname | Subject Alternative Names, chosen www/non-www name, and the listener serving that name |
| Browser reports an untrusted or incomplete chain | Intermediate certificate is missing or ordered incorrectly | Full-chain file or chain field supplied to the TLS terminator |
| Endless HTTP/HTTPS redirect loop | Proxy terminates TLS but backend does not receive a trusted HTTPS indication | X-Forwarded-Proto, the $_SERVER['HTTPS'] mapping, and proxy trust boundaries |
| Dashboard redirects to an internal hostname | Proxy replaced the public host in the backend request | Validated X-Forwarded-Host, Host, and WordPress URL values |
| Styles or images fail after HTTPS conversion | Stored absolute HTTP URLs create mixed content | Serialized-data-safe URL replacement, theme options, widgets, and plugin settings |
| Apache or Nginx will not reload | Syntax error, unreadable key, malformed certificate, or wrong path | Configuration-test output, file permissions, PEM formatting, and file paths |
| Correct certificate is installed but another one appears | Another HTTPS virtual host, listener, or edge binding is handling the request | DNS target, SNI hostname, default virtual host, and certificate-to-host binding |
Completion checklist
- Port 443 terminates at the intended server or proxy.
- The certificate covers the exact public hostname and the complete chain is installed.
- The private key matches the certificate and is protected from public access.
- The HTTPS virtual host or listener passes its configuration test and reloads successfully.
- Both WordPress URL fields use the canonical HTTPS origin without a trailing slash.
FORCE_SSL_ADMINis enabled only after HTTPS works.- Reverse-proxy deployments pass and validate the original host and protocol.
- HTTP redirects once, assets load over HTTPS, and login and admin pages remain usable.
- A serialized-data-safe backup and rollback procedure exists before bulk URL changes.
The Bottom Line
Install the custom certificate and matching key where HTTPS terminates, configure the full chain, set WordPress’s two URL values to the canonical HTTPS origin, and only then enable forced secure administration. If a proxy sits in front of WordPress, preserve and validate the original host and protocol; that is the key to avoiding redirect loops.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
