Redirecting a WordPress website from HTTP to HTTPS is not as easy as it should be. I have yet to understand why there isn’t a simple checkbox to complete this task. There’s also numerous references which provide inaccurate information of how to accomplish this task. I’ll explain how to accomplish this with Apache, Nginx, IIS, as well as some popular web hosting control panels. These configuration changes are not WordPress-specific and can be referenced for any type of website.
If you don’t already have a certificate, check out Let’s Encrypt to obtain a trusted certificate at no cost. In most cases Let’s Encrypt certificates can be easily requested from your CPanel or Plesk web hosting control panel.
Web server running Nginx can redirect HTTP traffic to HTTPS by adding the following code to the Nginx Configuration File.
server { listen 80; server_name domain.com www.domain.com; return 301 https://domain.com$request_uri; }
Web servers is running Apache can redirect HTTP traffic to HTTPS by adding the following code to the .htaccess file typically located at the root of your website or WordPress directory.
RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Assuming your WordPress .htaccess file has not been modified, it would look something like this:
# BEGIN WordPress RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] # END WordPress
Once updated any request to HTTP should be redirected to HTTPS.
Web servers running Microsoft’s IIS can leverage the URL Rewrite module. This applies to any type of website running on IIS (not just WordPress).
It might be possible to enable an seo-friendly 301 redirect from within your web hosting control panel. With this option there’s no need to modify your .htaccess file or web server configuration. If you’ve previously tried to locate this option, check again as it may have been recently added.