Replace HTTP URLs safely in a WordPress database

An HTTP-to-HTTPS move often leaves old URLs inside content and settings. A plain SQL REPLACE() looks tempting, but WordPress and plugins can store serialized values whose embedded string lengths would become wrong.

WordPress: use a serialization-aware replacement

First confirm HTTPS works, take a fresh database backup outside the web root, and prove you can restore it. Run WP-CLI from a trusted terminal against the intended installation. Check its home and siteurl options before making changes.

This example only previews changes to three named tables:

wp --path=/absolute/path/to/wordpress option get home
wp --path=/absolute/path/to/wordpress option get siteurl

wp --path=/absolute/path/to/wordpress search-replace \
  'http://example.com/' 'https://example.com/' \
  wp_posts wp_postmeta wp_options \
  --skip-columns=guid --precise --dry-run --report-changed-only

Replace the path, domain and table prefix with the verified values for your site. The trailing slash avoids matching a different hostname with the same prefix. Bare home/siteurl option values without that slash need their own deliberate settings update; this command will not change them. Review the listed tables and replacement counts. Audit additional plugin or multisite tables separately rather than automatically including every database available to that account.

--dry-run makes no replacements. Remove it only after reviewing the preview, arranging the write window and approving the backup. Keep the rest of the command identical. Avoid changing GUIDs as part of a routine site-address move.

What about a plain MySQL table?

For a column you know contains ordinary text—not serialized data, structured JSON or signatures—preview the result first:

SELECT id, body,
       REPLACE(body, 'http://example.com/', 'https://example.com/') AS proposed_body
FROM example_articles
WHERE body LIKE '%http://example.com/%'
LIMIT 20;

This is a read-only illustration, not a universal migration script. Confirm the table, column, transaction support and affected rows before writing. Do not globally replace every http://: third-party addresses may not support HTTPS, and a prefix such as example.com could also match example.com.other.invalid in unstructured text.

Afterward, inspect rendered pages, media, settings and mixed-content warnings; clear the relevant application caches. References: WP-CLI search-replace and MySQL string replacement.

Ever needed to update all links from HTTP to HTTPS in your database?

This query allows just that, simply change table_name_here, the 2x column_name_here occurrences and the yourdomain to your relevant info, and run! It will search that whole column (column_name_here) for http://yourdomain and replace it with your new https://yourdomain.


UPDATE table_name_here SET column_name_here = REPLACE(column_name_here, 'http://yourdomain', 'https://yourdomain')

It's to be noted that this query is completely reusable for pretty much any situation where you need to replace all occurrences of a string with another string. So give it a try the next time you need to update and replace a MySQL database string with another string.