Key takeaways
- An SSL/TLS certificate enables HTTPS, encrypting data between visitors and your site.
- Free certificates from Let’s Encrypt (via your host or Cloudflare) are as secure as paid ones for most sites.
- After enabling HTTPS: redirect HTTP to HTTPS, fix mixed content, update internal links and Search Console.
Browsers mark HTTP sites as “Not secure”, Google uses HTTPS as a ranking signal, and modern features like service workers require it. Every website needs HTTPS — and setting it up is usually free and quick.
SSL vs TLS#
“SSL” is the old name. Modern sites use TLS 1.2 or 1.3, but everyone still says “SSL certificate”. What matters: a valid certificate and HTTPS everywhere.
Types of certificates#
| Type | Validation | Use |
|---|---|---|
| Domain Validated (DV) | Proves control of the domain | Most websites; free via Let’s Encrypt |
| Organisation Validated (OV) | Verifies the organisation | Some corporate requirements |
| Extended Validation (EV) | Strict organisation checks | Rarely needed today; browsers no longer show a special green bar |
| Wildcard | Covers *.example.com |
Many subdomains |
Setting up HTTPS on WordPress#
- Install the certificate: most hosts have a one-click Let’s Encrypt option (cPanel → SSL/TLS Status → Run AutoSSL). With Cloudflare, use Full (strict) mode with an origin certificate.
- Update URLs: Settings → General → WordPress Address and Site Address to
https://. - Redirect HTTP to HTTPS sitewide with a 301 (host setting, Cloudflare “Always Use HTTPS”, or .htaccess):
RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] - Fix mixed content: run a search-replace of
http://yourdomain→https://yourdomainin the database (Better Search Replace orwp search-replace), and update hard-coded URLs in theme files. - Check pages in DevTools Console for “Mixed Content” warnings.
- Update Search Console (Domain property covers both), GA4 settings, ad links and social profiles.
- Optional: enable HSTS once everything works (tells browsers to always use HTTPS).
Need a hand with this?
Get a quick, honest review of your website’s SEO.
Common problems#
| Problem | Fix |
|---|---|
| “Not secure” despite certificate | Mixed content — images/scripts still on http:// |
| Redirect loop | Cloudflare in “Flexible” mode with server redirect; switch to Full (strict) |
| Certificate expired | Auto-renewal failed — check DNS points to the host and renew |
| Certificate name mismatch | Certificate doesn’t include www or the subdomain; reissue |
SEO notes#
HTTP→HTTPS moves are low-risk when done with 301 redirects. Keep the redirects permanently and make sure canonical tags and sitemaps use HTTPS. See HTTPS and migration guide.
SSL FAQ#
Is a free certificate good enough?#
Yes. Let’s Encrypt certificates provide the same encryption as paid DV certificates.
Do I need HTTPS without forms or payments?#
Yes. HTTPS protects privacy and integrity on every page, and browsers warn on HTTP.
How often do certificates renew?#
Let’s Encrypt certificates last 90 days and renew automatically on most hosts.