Code Bytes
Move WordPress to HTTPS without redirect loops
Establish working TLS, update the correct WordPress addresses and add HTTPS redirects in the layer that actually terminates the connection.
An HTTPS redirect cannot fix a missing certificate. Start by making the HTTPS site work directly, including the admin area, before you redirect visitors or change stored addresses.
Work in the right order
- Back up the site and database, and keep a recovery route that does not depend on a working WordPress login.
- Configure a valid certificate for every hostname you intend to serve. Check the origin connection too when using a CDN or reverse proxy.
- Confirm the correct WordPress Address and Site Address. They can differ when WordPress is installed in a subdirectory; do not make them identical automatically.
- Change their scheme to HTTPS, then replace old internal URLs using a serialization-aware tool such as WP-CLI.
- Enable the redirect at one clearly owned layer, then check for mixed content and redirect loops.
A direct-to-Apache example
If Apache itself receives the browser's TLS connection, this root .htaccess rule can redirect ordinary page requests before the CMS rules:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(?:GET|HEAD)$
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://example.com%{REQUEST_URI} [R=302,L]
Replace the hostname with your fixed canonical hostname. Test first; use 301 once the move is permanent. Existing query strings are retained. Forms and callbacks need their own HTTPS endpoints rather than relying on a browser converting a POST through a redirect.
Behind a proxy, do not copy the rule blindly
If TLS terminates before Apache, %{HTTPS} may remain off at the origin and this rule may loop. Use the hosting platform's documented HTTPS/proxy configuration, and trust forwarded protocol headers only from the verified proxy—not arbitrary visitors. Nginx and Cloudflare use different configuration mechanisms.
Delay HSTS, especially includeSubDomains or preload, until every affected hostname reliably supports HTTPS. A browser remembering HSTS cannot be fixed by simply removing a redirect.
References: WordPress HTTPS administration, Apache rewrite configuration and Cloudflare redirect-loop troubleshooting.
Original version18 October 2014
Kept here for reference and earlier links. The updated guide above is the recommended starting point; older code may depend on retired services or different software versions.
Editors Note: You will first need to purchase/install an SSL certificate and configure it with your server/hosting before any of the following will work or be of any use.
If you've recently purchased a HTTPS/SSL certificate for your Wordpress site you'll undoubtedly be looking for an easy way to get the whole site using HTTPS:// domain structure.
It's pretty simple.
- Visit your Wordpress settings
(/wp-admin/options-general.php)and add change theHTTP://toHTTPS://in both of the Wordpress Address (URL) and Site Address (URL) fields. - Add/update your wordpress
.htaccessfile to look like the following, ensuring you comment/un-comment the appropriate rule, depending on whether you use www. or not.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)\ HTTP/ [NC]
RewriteCond %{HTTPS} !=on [NC]
# Make sure only one of the following Rewrite rules is un-commented, choose the one that is appropriate for you (Either www, or none).
# For Non WWW:
RewriteRule ^/?(wp-admin/|wp-login\.php) https://%{HTTP_HOST}.co.uk%{REQUEST_URI}%{QUERY_STRING} [R=301,QSA,L]
# For www:
# RewriteRule ^/?(wp-admin/|wp-login\.php) https://www.%{HTTP_HOST}.co.uk%{REQUEST_URI}%{QUERY_STRING} [R=301,QSA,L]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
And now all of your WordPress site will automatically direct users to the HTTPS version of your site. Don't forget to add the HTTPS version to your Google webmasters/analytics and ensure you update any scripts etc that you can think of. Any questions just give me a shout on Twitter.
Keep exploring