HTTPS is mandatory today: browsers mark HTTP sites “Not secure”, search engines prefer HTTPS, and many features (payment forms, passkeys, service workers) require it. On a VPS, the certificate is free and renews itself. The WordPress-specific work is updating URLs so every page, image and script loads over HTTPS.

1. Install the certificate

With Nginx:

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

With Apache: python3-certbot-apache and certbot --apache. Certbot also adds an HTTP → HTTPS redirect. Details: Certbot with Nginx or with Apache.

Check that https://example.com loads before changing WordPress settings.

2. Update the WordPress address

Settings → General: change both WordPress Address (URL) and Site Address (URL) to https://…. Or with WP-CLI:

cd /var/www/example.com
sudo -u www-data wp option update home 'https://example.com'
sudo -u www-data wp option update siteurl 'https://example.com'

You’ll be logged out; log in again over HTTPS.

3. Replace old http:// URLs in content

Posts, widgets, theme options and page-builder data contain absolute URLs with http://. Replace them safely with WP-CLI (it handles serialized data correctly):

sudo -u www-data wp db export before-https.sql
sudo -u www-data wp search-replace 'http://example.com' 'https://example.com' --all-tables --precise --dry-run
sudo -u www-data wp search-replace 'http://example.com' 'https://example.com' --all-tables --precise
sudo -u www-data wp search-replace 'http://www.example.com' 'https://example.com' --all-tables --precise
sudo -u www-data wp cache flush

Don’t use a raw SQL REPLACE — it breaks serialized options. See WordPress search and replace.

4. Fix mixed content

A page served over HTTPS that loads any resource over HTTP has mixed content: browsers block scripts and iframes and may show a warning for images. Find the offenders:

  • Browser developer tools → Console shows “Mixed Content” warnings with the URLs.
  • Common sources: hard-coded URLs in theme files (header.php, CSS url(http://…)), old widgets, external embeds that don’t support HTTPS, and options saved by page builders.

Fix them at the source (theme files, plugin settings), then clear caches. As a safety net, this header asks browsers to upgrade remaining HTTP requests automatically:

add_header Content-Security-Policy "upgrade-insecure-requests" always;

Plugins like “Really Simple SSL” can do similar fixes at runtime, but fixing the data once is cleaner and faster.

5. Make sure WordPress knows it’s on HTTPS behind a proxy

If TLS terminates at a load balancer, Cloudflare or another proxy in front of your server, PHP sees plain HTTP and WordPress may loop redirecting. Tell it via wp-config.php:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
    $_SERVER['HTTPS'] = 'on';
}

Only add this when a trusted proxy sets the header. With Cloudflare, use SSL mode Full (strict), not Flexible. See WordPress too many redirects.

6. Secure the admin and cookies

define( 'FORCE_SSL_ADMIN', true );

Ensures logins and the dashboard always use HTTPS.

7. Redirects and canonical URLs

Make sure all variants redirect with a single 301 to your canonical HTTPS URL:

curl -sIL http://example.com | grep -iE '^(HTTP|location)'
curl -sIL http://www.example.com | grep -iE '^(HTTP|location)'

See Nginx HTTP to HTTPS redirects.

8. Update external services

  • Google Search Console: add the https:// property (or a Domain property covering all variants) and submit the sitemap.
  • Analytics: update the site URL.
  • CDN, social profiles, ad networks, email templates: update links.
  • Internal links in menus: custom links may still use http://.

9. HSTS (optional, once everything works)

add_header Strict-Transport-Security "max-age=31536000" always;

Browsers will then always use HTTPS for your domain. Read HSTS explained before adding includeSubDomains.

Troubleshooting

  • Too many redirects — proxy/Cloudflare mode, or home/siteurl mismatch.
  • Padlock missing on some pages — mixed content; check the console.
  • Certificate error on www — the certificate doesn’t include www; re-run Certbot with both names.
  • Admin login loop — clear cookies; check FORCE_SSL_ADMIN and proxy detection.

Every WordPress VPS from VPS.DO includes a dedicated IPv4 address, so Let’s Encrypt works out of the box for all your sites.

  • WordPress
  • SSL
  • HTTPS