Transport layer · Beginner · 20 minutes
How to add SSL to WordPress — The Certificate Is the Easy Half
The padlock is there on the homepage and missing on half the archive, and every http link is costing an extra round trip before anything renders.
The short answer
On our hosting the certificate is not the job: it issues automatically once the domain points here and renews itself before expiry. The work is in the URLs — set both WordPress Address and Site Address to https, redirect http to https in exactly one hop, then search-replace the protocol across the database so old posts stop loading assets over plain http.
Do the redirect carefully. Every extra hop between the first request and the final page is a full round trip added to time to first byte, and a chain of http to https to www to trailing-slash is a measurable cost paid by every visitor who types the bare domain.
By the HostingFast team · Reviewed 24 August 2026
Beginner
Assumed skill
20 minutes
Time at the keyboard
5
Stages in the runbook
24/7
Engineers on shift
This is a small migration wearing a small hat. The protocol change touches every generated link, every hardcoded asset and every integration holding a URL, so it deserves the same tidy-up pass any migration would get.
Before you start, load the site over https and open the browser console. The mixed-content warnings you see there are your task list, and they are far more specific than any plugin's summary screen.
Confirm what the platform already issued
Free SSL comes with every plan and issues as soon as the domain resolves to us, renewing itself long before expiry. Load https://yourdomain first and inspect the certificate — subject, expiry, issuer — before touching a single WordPress setting.
If the padlock is already clean on a fresh page and broken on an old one, you have confirmed the certificate is fine and the problem is content. That distinction saves people from buying a certificate to fix a database problem.
Two fields decide every link WordPress generates
Settings, then General: WordPress Address (URL) and Site Address (URL) both set to https. Every canonical tag, every menu link and every redirect WordPress builds flows from those two values, so they are the source of truth for everything downstream.
If you cannot reach the dashboard, the same pair can be defined in wp-config.php with WP_HOME and WP_SITEURL, which also stops anything overwriting them later. On a multisite or a site behind a proxy, that constant approach is the more predictable one.
One redirect hop, not three
All http requests should land on their https equivalent in a single 301. Our default configuration handles this already; if you would rather see the rule in writing, a short .htaccess block does the same thing. What you are avoiding is a chain — http to https, then non-www to www, then a trailing slash added — because each link in it is another round trip before the browser gets any HTML.
Test with `curl -sIL https://yourdomain` and count the 301s in the output. One is correct. Two is tolerable. Three means every visitor arriving from a printed URL is paying for your redirect rules before they see a pixel.
Mixed content, found and cleared in one pass
Old posts carry http:// hardcoded into image tags, iframes and inline styles. A database search-replace from http://yourdomain to https://yourdomain clears the archive in one operation — WP-CLI's `wp search-replace` handles serialised data correctly, which a raw SQL update does not.
Then update the ecosystem: Search Console property, analytics, webhooks and any integration holding a hardcoded URL. Finish by reloading the console on three or four old pages to confirm the warnings are gone rather than merely quieter.
Where the certificate is already handled
Every runbook here was exercised on the platform we actually operate — cPanel, LiteSpeed, NVMe storage, one-click installs — so the redirect defaults and panel screens match yours rather than a generic host's.
Every plan ships with a free SSL certificate that renews itself ahead of expiry — the padlock is never something you have to remember.
- Free SSL on every plan, renewed automatically before it can expire
- http to https handled in the default configuration
- SSH and WP-CLI on the developer-focused plans
- Human support on duty every hour of every day
Why HostingFast
Standard on every plan
The certificate is not your problem
Free SSL issues automatically once the domain points here and renews itself, so this guide starts at the URLs.
Two fields, one source of truth
WordPress Address and Site Address are where every generated link comes from — with the wp-config.php equivalent for lockout situations.
Redirect cost made visible
One curl command counts your redirect hops, because each extra hop is a round trip charged to every visitor.
Serialised data handled properly
The search-replace step uses the tool that understands serialised options instead of a raw SQL update that corrupts them.
The ecosystem included
Search Console, analytics and hardcoded integration URLs all move too — a protocol switch is a small migration.
Scoped honestly
Getting every page onto https is a beginner-level job — about 20 minutes, most of it the search-replace and the check.
Quick Start
From order to online
- 1
Inspect the certificate that is already there
On our hosting the free certificate issues automatically once the domain points here. Load the site over https and check subject, issuer and expiry before you change anything inside WordPress.
- 2
Set both address fields to https
Settings, then General: WordPress Address and Site Address. Or define WP_HOME and WP_SITEURL in wp-config.php if the dashboard is unreachable or you want them pinned.
- 3
Get the redirect down to one hop
Every http request should reach its https equivalent in a single 301. Our default configuration does this; a short .htaccess rule spells it out. Confirm with `curl -sIL` and count the 301s.
- 4
Search-replace the protocol across the database
Old posts hardcode http:// into images, iframes and inline styles. Use `wp search-replace 'http://yourdomain' 'https://yourdomain'` so serialised options survive the pass intact.
- 5
Move the ecosystem and re-check the console
Search Console, analytics, webhooks and any integration with a stored URL. Then reload three or four old pages with the browser console open and confirm zero mixed-content warnings.
Built In
Loaded onto every plan
- Free SSL on every plan, renewed automatically before it can expire
- LiteSpeed caching built into the server rather than patched in by plugin
- NVMe SSD storage on every tier, not just the expensive ones
- SSH, Git and Composer on the developer-focused plans
- Per-site PHP version switching from the control panel
- Staging environments for testing changes before they ship
- Daily backups, with self-service restores you run from the panel
- cPanel — the control panel most of the industry already runs
- Human support on duty every hour of every day
- Zero setup charges — there is no joining fee, ever
Frequently Asked
What people ask us most often
Does an extra redirect hop really cost measurable time?
Yes, and it is easy to quantify: each hop is a full round trip before the browser receives any HTML. On a link typed as a bare domain, a chain of three 301s can add several hundred milliseconds to time to first byte against Google's 800 ms good boundary. Run `curl -sIL` on your own domain and count them — most sites find at least one hop they can delete.
What is the fastest way to find every mixed-content URL?
The browser console on three or four of your oldest posts, which names the exact resource and the exact page. Then fix them in bulk with `wp search-replace` rather than one at a time. A plugin that rewrites http on the fly hides the problem at render time and leaves the database wrong, which surfaces the moment you disable it.
How is billing handled, and does the price move at renewal?
Card payment through a secure checkout, and renewals bill at the rate you originally ordered at — there is no introductory price waiting to expire. Invoices sit in your client area and auto-renewal is a toggle in your account, so stopping it never involves a phone call.
How many sites can share a single account?
From the Turbo tier upwards, several — each with its own domain, mailboxes and certificate inside one account. They do share that account's PHP workers and disk I/O, so if the extra sites belong to clients rather than you, reseller hosting keeps them properly isolated instead.
Keep reading
How to Set Up WordPress Caching
Get LiteSpeed Cache serving hits on the first pass, and prove it from the response headers — beginner, roughly 30 minutes.
How to Enable Two-Factor Authentication
Make a stolen password worthless on every login that matters — beginner, about 15 minutes.
Best Wix vs WordPress
The trade weighed on the numbers that change: control, plugin access, and what each option does to your page weight.
Node.js Hosting
Run Node.js applications alongside your sites, with SSH and Git included.
WordPress Hosting
WordPress on LiteSpeed and NVMe, with staging clones and daily backups included.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Start with the padlock already handled.
Free SSL that issues and renews itself, http to https by default, NVMe behind LiteSpeed and support that answers at any hour.
View WordPress Hosting plans