What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Move a WordPress site to HTTPS in this order: back up the files and database, install and test a valid TLS certificate, change both WordPress URL settings, replace stored HTTP links, remove mixed content, add permanent HTTP-to-HTTPS redirects, update SEO signals, and test every important workflow. Changing only the address in Settings → General is not a complete migration.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What changes when you move WordPress to HTTPS?
HTTP and HTTPS are different URL schemes. A page at http://example.com/about/ and the same page at https://example.com/about/ are separate URLs to browsers, WordPress, caches and search engines. HTTPS adds TLS encryption between the visitor and the web server, authenticates the server with a certificate and allows browsers to apply secure-cookie and mixed-content protections.
As an Amazon Associate I earn from qualifying purchases.
The migration should preserve the hostname, paths and query strings while changing the scheme. A request for an old HTTP URL must receive a permanent redirect to its HTTPS counterpart. Internal links, canonical tags, XML sitemaps, feeds, hreflang references, structured-data URLs, media links and API endpoints should then use HTTPS directly rather than relying on repeated redirects.
WordPress is “fully compatible with HTTPS when an TLS / SSL certificate is installed and available for the web server to use,” according to the WordPress Advanced Administration Handbook. Compatibility does not mean that every plugin, theme, database field or external embed will be corrected automatically.
#1 Best Overall
Plan the migration before touching URL settings
Record the current site
Write down the exact current values for the public URL, WordPress core URL, hosting arrangement, CDN or reverse proxy, cache layers and certificate owner. Note whether the site uses a single domain, a www hostname, multiple domains, language subdirectories, a separate media domain or an external checkout. HTTPS must be configured for every hostname that visitors and services will use.
Back up files and the database
Download the complete WordPress files, including wp-content, uploads, themes, plugins and the wp-config.php file. Export the database separately. Store both copies outside the live document root and verify that the archive can be opened and the database can be restored to a test location. WordPress migration guidance places the file and database backups before URL changes for a reason: a bad replacement or redirect rule can otherwise make recovery difficult.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose a maintenance window
Schedule the change when you can inspect logs and test forms, accounts, payments, webhooks and integrations. Lower cache times beforehand if your infrastructure allows it, and tell anyone editing content to pause during the URL change so new HTTP links are not created while the database is being rewritten.
Install and verify TLS before changing WordPress
Obtain a certificate covering the exact hostname or hostnames in use, install the certificate chain on the TLS termination point, and configure the HTTPS virtual host. TLS may terminate at the origin server, a CDN or a reverse proxy; the choice affects where certificates are installed, where redirects are enforced and which component must be renewed.
| Termination point | What you configure | Important checks |
|---|---|---|
| Origin web server | Certificate, private key, certificate chain and HTTPS virtual host on the WordPress server | HTTP and HTTPS virtual hosts select the intended site; renewal reloads the server without downtime |
| CDN or edge network | Certificate and HTTPS listener at the edge, plus a secure connection from edge to origin if configured | The edge sends the correct forwarded-protocol header and the origin does not redirect an already-secure request back to HTTP |
| Reverse proxy or load balancer | Certificate at the proxy and an HTTPS-aware origin configuration | WordPress receives the original HTTPS state; health checks, webhooks and administrative access follow the same path |
Before editing WordPress, open the site over HTTPS in a private browser window. Check the homepage, a representative post, an image, /wp-login.php and /wp-admin/. The certificate should match the hostname, be within its validity period and present a complete chain. Confirm that the HTTPS virtual host serves this WordPress installation rather than a default server page.
Do not enable a blanket redirect until the HTTPS site itself works. If HTTPS fails first, a redirect can hide the original problem and make both protocols appear broken.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Change the two WordPress URL values
Use the WordPress dashboard
- Sign in to WordPress over HTTPS.
- Open Settings → General.
- Change WordPress Address (URL) from
http://to the matchinghttps://URL. - Change Site Address (URL) to the matching
https://URL. - Use the same hostname and path that the certificate and public site use. Do not add a trailing slash to either value.
- Save the changes, then sign in again when WordPress reloads the login screen.
The WordPress Address is where core files reside; the Site Address is the public address visitors use. They are often identical, but both must reflect HTTPS when the installation and public site share the same location.
When wp-config.php controls the values
If the fields are locked or do not retain your edits, inspect wp-config.php for constants such as:
define( 'WP_HOME', 'http://example.com' );
define( 'WP_SITEURL', 'http://example.com' );Change those constants to the HTTPS values, without a trailing slash:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Do not maintain conflicting values in both the database and configuration file. The constants override the General Settings fields, so changing only the dashboard can appear to have no effect.
What WordPress 5.7 and later can do automatically
WordPress 5.7 introduced improved HTTPS detection and migration support. When WordPress recognizes that the site is HTTPS and the domains match, core can replace insecure home URLs in frontend output. The developer function wp_update_urls_to_https() updates the home and siteurl options to their HTTPS variants.
This behavior is conditional. It does not prove that a plugin setting, serialized option, theme stylesheet, custom field, CSS file, JavaScript request, iframe or external service has been updated. Continue with a complete search and mixed-content audit.
Replace HTTP URLs safely in the database
Changing the two URL options does not rewrite old links stored in post content, widgets, menus, theme options, custom fields or plugin tables. Search for the old origin, not merely the text http://, because unrelated external URLs may intentionally remain HTTP or may require separate decisions.
Use a backup-aware search-and-replace process
- Take a fresh database backup immediately before the replacement.
- Run the replacement on a staging copy first when possible.
- Search every relevant table for the exact old origin, including tables created by plugins.
- Preserve serialized PHP data. Use a tool that understands serialized strings rather than a raw SQL replacement.
- Run a dry run, review the number and location of matches, then execute the replacement.
- Clear object, page, CDN and browser caches after the live replacement.
WordPress documentation identifies migration plugins and WP-CLI as supported approaches. With WP-CLI, a typical same-domain replacement can be previewed like this:
wp search-replace 'http://example.com' 'https://example.com' --all-tables --skip-columns=guid --dry-runAfter reviewing the report, run the same command without --dry-run. The --skip-columns=guid option leaves post GUIDs unchanged; GUIDs are identifiers rather than visitor-facing links and changing them can create unnecessary feed or syndication changes. Add --recurse-objects when your data contains serialized or recursively stored objects and your WP-CLI version supports it:
wp search-replace 'http://example.com' 'https://example.com' --all-tables --skip-columns=guid --recurse-objectsDo not run a generic command that replaces every http:// string across the database. It can corrupt unrelated values, alter third-party URLs unexpectedly or change data that should remain outside your domain.
Check files and settings outside the database
- Search theme templates, child-theme files and custom CSS for the old origin.
- Review plugin settings for API endpoints, image hosts, callback URLs, license servers and webhook destinations.
- Inspect widgets, navigation menus, reusable blocks and custom HTML.
- Check environment variables, deployment manifests and hard-coded URLs in build assets.
- Update documentation, email templates and feeds generated outside WordPress.
Find and remove mixed content
Mixed content occurs when an HTTPS page requests an insecure HTTP resource. Browsers may upgrade some passive requests, warn about others or block active resources entirely. Active examples include JavaScript, CSS, fonts and iframes. Images, video, audio, form actions, WebSocket connections, AJAX calls and API requests also deserve inspection because behavior varies by browser and context.
Use the browser to locate every insecure request
- Open an affected page in a private window.
- Open Developer Tools and select the Console tab. Filter for “mixed content” and “blocked”.
- In the Network tab, reload the page and search requests for
http://. - View the page source and inspect generated HTML, inline styles and script attributes.
- Record the requesting file, the insecure URL and the WordPress setting or template that generated it.
- Replace the resource with its HTTPS URL, host it locally over HTTPS, or remove it if it is obsolete.
Do not use protocol-relative URLs such as //cdn.example.com/file.js as a universal fix. Prefer an explicit HTTPS URL so future code and security reviews have an unambiguous scheme. If a third-party service has no HTTPS endpoint, replace the service or remove the resource; leaving an insecure script or frame can cause blocking and security exposure.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common sources of persistent mixed content
- Old image URLs embedded in post content or serialized page-builder data.
- Theme CSS that references background images with HTTP URLs.
- Plugin JavaScript or stylesheet registrations using an HTTP source.
- Font files loaded from an insecure host.
- Embeds, advertising frames or video players that do not support HTTPS.
- Forms whose
actionstill posts to HTTP. - REST, AJAX, webhook or WebSocket endpoints assembled from an old setting.
- Cached HTML generated before the migration.
Clear all relevant caches after each correction. A cached page can continue to show an old URL even after the database and templates are correct.
Redirect every HTTP URL to its HTTPS equivalent
Keep the HTTP endpoint available and issue a permanent redirect for each old URL. Preserve the path and query string: http://example.com/shop/item/?ref=email should reach https://example.com/shop/item/?ref=email. Redirecting every request to the homepage discards context and can create broken links.
Where to place the redirect
Enforce the redirect at the web server, load balancer or edge layer rather than relying solely on a WordPress plugin. Server-level redirects run before PHP, work for static files and remain available if WordPress has an error. A plugin can still help manage application-specific cases, but it should not create a chain of redirects after the server has already redirected.
Apache example
For an Apache server where HTTPS is terminated directly at Apache, a minimal rule in the HTTP virtual host or appropriate rewrite configuration is:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,NE]Use your server’s preferred canonical hostname instead of accepting arbitrary host headers when multiple hostnames are possible. Test the rule in staging, because rewrite context and existing rules vary by host.
Nginx example
For Nginx with separate HTTP and HTTPS server blocks, the HTTP block commonly contains:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}Set the destination hostname to your canonical host. If you use a proxy or CDN, do not copy an origin-only rule blindly. The proxy must pass the original protocol and the origin must trust that signal; otherwise an HTTPS visitor can be redirected repeatedly between proxy and origin.
Test for chains and loops
- Request the HTTP homepage, a deep post, a media file and a URL with a query string.
- Confirm one permanent redirect goes directly to the final HTTPS URL.
- Test both
wwwand non-wwwhostnames if both previously resolved. - Check that an HTTPS request returns the page without another redirect.
- Test trailing-slash and canonicalization rules together so they do not create a chain.
Handle reverse proxies correctly
When TLS ends at a proxy, the connection from proxy to origin may be HTTP even though the visitor’s connection is HTTPS. WordPress must receive a trustworthy forwarded-protocol value and be configured to recognize it. If it believes every request is HTTP, WordPress or a redirect rule can send the browser to HTTPS again, creating an infinite loop.
Ask the proxy or hosting provider which header conveys the original protocol, restrict trust to requests from that proxy, and configure the web server and WordPress accordingly. Test the login page, admin pages, REST requests, cron callbacks and webhooks through the public hostname. Never trust an arbitrary client-supplied forwarding header on a server that is directly exposed to the internet.
Update SEO signals after the scheme change
Google treats an HTTP-to-HTTPS change as a site move at the URL-scheme level. Redirects and consistent canonical signals transfer the relationship between old and new URLs; they do not make the old scheme disappear instantly.
Update on-site signals
- Set canonical URLs to HTTPS.
- Change internal links, navigation, pagination and image links to HTTPS.
- Regenerate XML sitemaps with HTTPS URLs.
- Update RSS and Atom feeds.
- Change hreflang alternates and structured-data URLs.
- Update Open Graph, social-card and sharing metadata.
- Review
robots.txtand ensuresitemap.xmlresolves over HTTPS.
Verify both protocol variants in Search Console
- Verify the HTTPS property and retain access to the HTTP property.
- Inspect representative HTTPS URLs, including the homepage, a post, a category, an image and a page requiring login.
- Submit the HTTPS sitemap.
- Monitor indexing, redirect and “Not found” reports.
- Investigate spikes in crawl errors, blocked resources or duplicate canonical selections.
Google notes that crawling can temporarily increase after a site move. Keep the HTTP redirects active while search engines and external sites update their links. Do not remove the old endpoint immediately after the first successful test.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test the production site systematically
Test as both an anonymous visitor and an authenticated user. Use a fresh browser profile or private window so cached redirects and cookies do not hide problems.
Recommended Free Tools
| Area | What to verify | Failure clues |
|---|---|---|
| Core pages | Homepage, posts, pages, archives, search and 404 page load with HTTPS | Redirect loops, wrong host, blank templates or stale HTTP links |
| Authentication | Login, logout, password reset and admin navigation work | Repeated login prompts, secure-cookie warnings or redirects to HTTP |
| Media | Images, downloads, audio, video and responsive variants load | Blocked requests, broken thumbnails or insecure media URLs |
| Forms and commerce | Contact, registration, checkout, payment return and email delivery complete | Form-action warnings, failed callbacks or third-party rejection |
| Integrations | REST API, AJAX, webhooks, scheduled jobs and external callbacks respond | 401/403 errors, signature mismatches, timeout or wrong callback scheme |
| Crawling | robots.txt, sitemap.xml, canonical tags and feeds use HTTPS |
HTTP references, blocked sitemap or canonical mismatch |
| Infrastructure | CDN cache, origin health checks, logs and certificate renewal work | Serving an old certificate, cache poisoning or renewal failure |
Use command-line HTTP checks if available. For example, request headers from both schemes and inspect the complete redirect chain:
curl -I http://example.com/example-path/
curl -I https://example.com/example-path/
curl -IL http://example.com/example-path/The first command should show a permanent redirect, the second should show the final response, and the third should reveal any unexpected chain. Replace the example path with a real deep URL, not only the homepage.
Common problems and precise fixes
The dashboard is inaccessible after changing URLs
Use the database or the wp-config.php constants to restore a temporarily reachable HTTPS value, then verify the certificate and hostname. If a proxy is involved, correct forwarded-protocol handling before trying another URL change. Restore the pre-migration database only when configuration repair cannot recover the site.
There is an infinite redirect loop
Check every redirect layer: CDN, load balancer, web server, WordPress plugin and application code. A proxy commonly reports HTTPS to the browser but HTTP to WordPress. Configure trusted protocol forwarding and ensure the origin rule does not redirect requests that the proxy already received securely.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Some pages show a padlock warning
Open the browser console and network log, identify each HTTP resource, then correct the generating setting, template or database value. Clear caches and test the page source again. A padlock warning is not fixed by changing only the homepage URL.
Images or styles disappear
Inspect the failed request URL and the server response. Replace HTTP asset URLs, check file permissions and confirm that the HTTPS virtual host points to the same document root and upload directory as HTTP. If a CDN rewrites asset URLs, purge its cache after correcting the origin.
Search traffic or indexed URLs look unstable
Confirm one-to-one permanent redirects, HTTPS canonicals and an HTTPS sitemap. Check Search Console for crawl errors and inspect representative URLs. Do not block the old HTTP URLs in robots.txt before crawlers can follow their redirects.
Rollback and recovery
If a critical workflow fails, record the failing URL and error before changing more settings. Temporarily disable the newest redirect or plugin rule, restore the last known-good configuration and keep the certificate installed. If database replacements caused corruption, restore the verified database backup and repeat the replacement on staging with a serialization-aware tool. Keep HTTP available for redirects even during recovery; removing it can strand old links and make diagnosis harder.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteAfter recovery, identify whether the fault came from TLS, proxy headers, URL options, serialized data, mixed content, cache, plugin behavior or an external integration. Correct that layer first, then resume the migration in small, testable steps.
How to know the migration is complete
- Both WordPress URL values resolve to the intended HTTPS origin with no trailing slash.
- The certificate is valid for every public hostname and renewal ownership is documented.
- Database, theme, plugin and template audits find no unintended HTTP references to your own site.
- All HTTP URLs redirect once to the matching HTTPS path and query string.
- Browser consoles show no blocked mixed content on important templates.
- Anonymous and logged-in workflows, forms, APIs, webhooks, cron and media have passed.
- Canonical tags, feeds, sitemaps, hreflang and structured data use HTTPS.
- Both protocol properties are monitored in Search Console and server logs.
- Backups and a tested rollback path remain available until indexing and integrations are stable.
The Bottom Line
A safe WordPress HTTPS migration is a coordinated server, WordPress, content, redirect and SEO change. Back up first, make TLS work before changing URLs, update both address settings, replace stored links without damaging serialized data, remove mixed content, redirect every old URL directly, and monitor the live site after launch.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
