Ultimate Guide On How To Configure An SSL Certificate In WordPress
Disclaimer: Prior to completing our tutorials, we always recommend that you take a full backup of your website (both database and files) just incase that something goes wrong (every website is different).
In this Studio9 guide we will show you how to configure an SSL certificate in WordPress. This guide assumes that you have already installed the SSL certificate onto your hosting account (or your host has already done so for you). If you have not already done this, please ask the host of your website to do this for your website and they should be able to help (or get in touch here and we will be able to assist you).
You will need to install the following two plugins for this tutorial: Search & Replace and Really Simple SSL. To install them, please download them by clicking the link, then click Plugins within WordPress, then ‘Add New’ and ‘Upload’. Once uploaded, make sure that you activate the plugins.
The first step once both plugins have been activated is go to the Settings tab then click SSL. The page should then look like the following image.
Once you are on this page, navigate to the ‘Settings’ tab at the top. On this page, select the boxes next to ‘Mixed Content Filter’, ‘Enable WordPress 301 redirection to SSL’ and ‘Enable 301 .htaccess redirect’ – the .htaccess redirect selection works in 99% of cases but double check with your developer if you have a complex website or hosting set up. The plugin states “A .htaccess redirect is faster. Really Simple SSL detects the redirect code that is most likely to work (99% of websites), but this is not 100%. Make sure that you know how to regain access to your site if anything goes wrong!”.
Once completed, press ‘Save’ at the bottom of the page. Navigate back to your website to check if the green https:// appears (secure padlock).
If the padlock does not appear (it would display a padlock icon next to it), then that means there are insecure links within the content. The easiest way to check why the padlock isn’t appearing is the following: go to the website Why No Padlock and enter your website URL (including https). It will then report on there why it is not appearing. Usually, the reason is that within the content, it is trying to load in http:// imagery rather than https://.
This is where the Search & Replace plugin comes in handy. This is quite advanced and could break your website if used incorrectly or if you have a complicated website set up, please contact your developer if you aren’t technically savvy or get in touch with us and we would be more than happy to help.
Navigate to Tools and then select Search & Replace. Select the ‘Create SQL file’ button which will backup your database as any changes to the site using this plugin will affect the database so it is always good to have a backup. Once completed, click the ‘Search & Replace’ tab at the top and the screen should look like the following.
The Search & Replace plugin will search your database for what you enter in the search for field and replace them with what you enter in the replace with field. Check the result for the Why No Padlock and see what web address the website is trying to load in that is insecure (it should be images on your domain).
What you should then type in to the search for field is the following:
and the replace with field https://yourwebaddress – if you have set the site up as https://www.yourwebaddress then you can replace it with this instead
Make sure that you then select all of the tables and untick ‘Dry Run’ and select ‘Save Changes to Database’.
What this is doing is replacing your http:// web address within the database with the new, secure SSL web address which is https://. Once done, do the same thing again but instead of searching for http://yourwebaddress, use http://www.yourwebaddress – this would make sure that all http URL’s for your website itself within the database have been replaced with the new secure https://. Make sure that you replace yourwebaddress with the actual web address of your website.
Navigate back to the Why No Padlock website and enter your web address again, hopefully this time it should display that there is no longer any mixed content and your website should load the secure padlock absolutely fine.
If this still has not worked, there are two possibilities for this:
1. The website is loading imagery from the theme files using http:// rather than https://, you will need to edit these theme files and update the link(s).
2. If you are sure that the images that are displaying on Why No Padlock as loading insecurely are within the content on the page itself rather than the theme code, you may need to go to the relevant page where that image appears, edit the image and select it again in the media library and click update. This will force the site to use the updated SSL secure image. You will need to do this for each image (and you can see the individual images that need updating via Why No Padlock).
Once these have been sorted out your SSL should appear and your website load fully as https://. You can test each page for free using Why No Padlock and it will tell you why the page isn’t loading securely. As a reference, if your site is fully secure, this is how it appears on Why No Padlock.
If you have any questions or need any assistance, please do not hesitate to contact one of our team members via email on email@example.com and we will get back to you as soon as possible. We would love to hear your feedback also, whether positive or negative, using the comments below.
Thanks for taking a look at our ultimate guide on how to configure an SSL certificate in WordPress.