Table of Contents
Installing an SSL certificate makes https:// available on your site, but visitors and old links can still land on the unencrypted http:// version unless you actively redirect them. Here are the three common ways to force that redirect.
Before you start
Confirm your SSL certificate is actually installed and active first — check for the padlock icon when you visit https://yourdomain.com directly. Forcing a redirect before the certificate is live will lock visitors out of your site entirely.
Method 1: Update your WordPress Address settings
In wp-admin, go to Settings → General and make sure both "WordPress Address (URL)" and "Site Address (URL)" start with https://. This alone fixes internal links but doesn't force a redirect for visitors who type http:// directly.
Method 2: Add a redirect rule in .htaccess
For Apache servers (which most shared hosting uses), add this to the top of your .htaccess file, right after the opening WordPress rules block:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
This catches every request that isn't already secure and sends a permanent 301 redirect to the https:// version.
Method 3: Use a plugin
If editing .htaccess feels risky, a plugin like Really Simple SSL detects your certificate automatically and handles the redirect and mixed-content fixes for you with no code editing at all — a good option if you're not comfortable in server files.
Watch for mixed content warnings
After forcing HTTPS, some pages may show a "not fully secure" warning if images, scripts, or stylesheets are still hardcoded to http://. Really Simple SSL and similar plugins usually include a mixed-content fixer for this.
If you're behind Cloudflare
A common redirect-loop cause is Cloudflare's SSL mode set to "Flexible" while your own server also redirects to HTTPS — this creates an endless loop. Set Cloudflare's SSL mode to "Full" or "Full (strict)" once your origin certificate is installed to avoid this.
Key takeaway: Always test in an incognito window after making the change — if you see "too many redirects," it's almost always a mismatch between your CDN/proxy SSL setting and your server's own redirect rule, not a mistake in the rule itself.