How-to · Beginner · 20 minutes
How to Add SSL to WordPress
Serve every page over https with the padlock staying shut on all of them — a practical, jargon-free walkthrough with the classic mistake flagged before you make it.
Straight answer first
In a line: serve every page over https with the padlock staying shut on all of them — a beginner-level task that takes 20 minutes.
The walkthrough below covers every step, the mistake most people make, and the shortcut worth keeping. On Hosting Seller plans several of these steps are already done for you, and we say where.
Written by the Hosting Seller staff · Checked 1 August 2026
Beginner
Difficulty level
20 minutes
Time to allow
5
Stages
24/7
Help at any hour
This guide assumes no expertise at all — just a hosting account, a browser and 20 minutes of attention. Every instruction works on our platform exactly as written, and carries over to any standard cPanel host.
One promise before you start: nothing in this guide is irreversible. Where a step could bite, we say so and give you the undo.
The shape of the work
Here is the route in full: check the certificate is there, change the site address settings, force http visitors across, chase down mixed content and tell everything else.
Each stage is a few minutes of steady clicking — the time it takes depends mostly on how familiar the control panel already feels. The detailed steps sit further down this page; skim the whole route once before you begin.
Where this goes wrong, and how not to
Changing the site URL and skipping the database search-replace. Every image embedded before the switch still loads over http, so browsers keep flagging your secure site as not quite secure and nothing looks obviously wrong.
It is worth learning because it is not some rare edge case — it is the single most common reason this task turns into a support ticket. Knowing it up front turns the whole job from risky into routine.
One habit that makes this easy for good
Check the result in a private window with the cache cleared. Your own browser remembering the http version of the site is far and away the most common reason people report it as still broken.
Small habits like this are the real difference between people who find hosting easy and people who find it stressful. The tools are identical; the working method is not.
What you can skip on a Hosting Seller plan
Several steps in this guide exist only because hosting historically made you do them. On our plans SSL issues itself, backups run daily without being asked, and one-click installers replace the manual setup entirely. What is left is the part that is genuinely yours.
Stuck halfway through at an odd hour? That is exactly what round-the-clock human support is for — tell us where you are in this guide and we will pick it up from there.
A good platform makes every guide shorter
Every walkthrough on our how-to shelf is tested on the platform we actually run — cPanel, LiteSpeed, NVMe, one-click installs — so the instructions match your screen instead of gesturing vaguely at it.
SSL comes free with every plan and reissues itself before it lapses, so nobody has to diary the padlock.
- Step by step, tested exactly as printed
- The snag flagged before you reach it
- The dull steps are already automated
- People on hand at any hour if you stall
Why Hosting Seller
On every plan, as standard
Written from real tickets
Our guides come off the support desk, so the snags flagged here are the ones people genuinely hit.
Automation where it belongs
SSL, backups and installs run themselves here, so the guide covers only what is genuinely yours to do.
Works exactly as written
Every step tested on the platform we run — no 'your host may differ' hand-waving anywhere.
Help on the counter
Stuck on step three at midnight? Support answers at any hour, mid-guide included.
The snag, named early
The classic mistake for this exact job is flagged before step one, so 20 minutes stays 20 minutes.
Scoped honestly
Serve every page over https with the padlock staying shut on all of them is a beginner-level task — this guide budgets 20 minutes and says which steps the platform absorbs.
First Steps
From choosing to live
- 1
Check the certificate is there
On our hosting the free certificate issues by itself once the domain points here. Load the site with https in front and look at the padlock before you change a single setting inside WordPress.
- 2
Change the site address settings
Settings, then General, and set both the WordPress Address and Site Address to https://. WordPress builds every link it writes from those two fields, so they are the source everything else follows.
- 3
Force http visitors across
Every plain http request should be sent to the https version sitewide. Our default configuration does this already; a short .htaccess rule does the same job if you want it written down explicitly.
- 4
Chase down mixed content
Old posts have http:// baked into image tags and embeds. Run a database search-replace from http://yourdomain to https://yourdomain and the padlock stops flickering between pages.
- 5
Tell everything else
Search Console, analytics and any integration with the URL hardcoded should all reference the https address now. A protocol change is a small migration and deserves the same tidying up.
In the Box
Packed with every plan
- Spam and virus filtering fitted to every mailbox
- Real people on the counter, every hour of every day
- cPanel, the panel the rest of the trade already knows
- NVMe SSD storage on every shelf, not just the top one
- A 30-day money-back guarantee on every hosting plan
- DDoS filtering handled out at the network edge
- A 99.9% uptime commitment, watched by monitoring day and night
- The Softaculous installer for one-click application setup
- One-click installs for WordPress and 400+ other applications
- Nothing added at setup — no joining fee, ever
Across the Counter
The questions we get asked most
The padlock is there but carries a warning — why?
Mixed content. The page itself arrives over https but something on it — usually an old image — is still requested over http. A database search-replace of the protocol across the whole archive clears it in one pass.
Does switching to https change anything for SEO?
For the better, permanently. Https is a confirmed ranking signal and the 301 redirects carry your existing standing across the switch. As migrations go it is among the safest a site will ever perform.
How do I pay, and does it bill again on its own?
Orders go through a secure checkout by credit or debit card, and the renewal is taken at the same price you first paid. Every invoice sits in the client area for you to read, and switching auto-renewal off is a toggle in your account rather than a phone call.
Can one plan hold more than a single website?
From the Pro tier upward, yes — several sites, each with its own domain, mailboxes and certificate, all under one account. If those extra sites belong to clients rather than to you, reseller hosting is the better fit: it gives each one proper separation.
Which control panel comes with the account?
cPanel, which the whole trade already knows. That means every tutorial online matches what you see, your backups restore onto any cPanel host anywhere, and what you learn here stays useful for life. Plesk and DirectAdmin are stocked on specific plans for anyone who prefers them.
Does the price climb when the term is up?
No. What you pay to order is what you pay to renew, year after year. We do not run teaser rates, so there is no year-two ambush waiting in the calendar, and your bookkeeping can treat the hosting line as a fixed number.
What happens to my files if I leave?
The site and the files stay yours. Pull a full backup from the panel whenever you like, before or during cancellation. Domains remain registered in your name for the term you paid for and can move to any registrar once the standard 60-day window has passed.
Read next
How to Create a WordPress Child Theme
Customise a theme in a way that survives the next update intact — intermediate level, about 30 minutes.
How to Free Up Mailbox Storage
Get space back before senders start receiving bounce messages — beginner level, about 30 minutes.
WordPress Hosting
WordPress looked after for you — LiteSpeed caching, staging copies and daily backups.
VPS Hosting
KVM virtual servers with root access, DDoS filtering and one flat price.
Packing up and moving host? Take our checklist.
A plain running order for a move nobody notices: what to copy first, how to carry email across without dropping a single message, when to point DNS, and the two slips behind nearly every hour of downtime we get called about.
Get online, with no games at checkout.
Quick NVMe hosting, SSL and the move in included, and real people on the counter at any hour — on a price that doesn't shift.
See the plans