How do I force HTTPS on my website? Print

Once an SSL certificate is installed for your domain (see What is SSL?), you should send all visitors to the secure https:// version of your site. Otherwise browsers may still show a "Not Secure" warning on the http:// version.

1. Confirm your certificate is active

In cPanel, open Security > SSL/TLS Status and check your domain is covered. Then visit https://www.yourdomain.com and look for the padlock.

2. Turn on Force HTTPS Redirect

1. In cPanel, open Domains.
2. Find your domain and switch Force HTTPS Redirect to on.

Visitors who type http:// will now be sent automatically to https://.

3. WordPress sites

1. In your WordPress dashboard, go to Settings > General and set both the WordPress Address and Site Address to start with https://.
2. If some images or scripts still load over http (a "mixed content" warning), install a plugin such as Really Simple SSL to update them automatically.

Still seeing "Not Secure"? It is usually mixed content – a page element (image, script, or stylesheet) loading over http://. Update those links to https://, or use the plugin above. If the certificate itself is missing, see Can I access my secure pages as https://www.mydomain.com/? or contact support.