Having an SSL certificate doesn't stop visitors reaching the insecure http:// version of your site. Forcing HTTPS sends everyone to https:// automatically. Do this once your certificate is working.
Before you start
Make sure the domain has a valid certificate. Open Security › SSL/TLS Status in cPanel or run the domain through our SSL checker. If the domain isn't covered yet, see free SSL with AutoSSL first. Forcing HTTPS without a certificate causes browser warnings.
Turn on Force HTTPS Redirect in cPanel
- Log in to cPanel and open Domains › Domains.
- Find your domain in the list.
- Switch on the Force HTTPS Redirect toggle for that domain.
- Repeat for any other domains or subdomains you want to secure.
If the toggle is greyed out, cPanel can't find a valid certificate for that domain yet. Run AutoSSL, then try again.
WordPress sites
- Log in to WordPress and go to Settings › General.
- Change both WordPress Address (URL) and Site Address (URL) to start with
https://, then click Save Changes. You'll need to log in again. - If the padlock is missing or shows a warning, some images, scripts or stylesheets are still loading over
http://("mixed content"). Our free plugin can fix these links for you. See the EDZNET WP HTTPS plugin guide.
Using .htaccess instead
If you need more control, for example to redirect to www and HTTPS in one step, you can write the redirect yourself. See using .htaccess for redirects and friendly URLs. Don't combine your own HTTPS rule with the cPanel toggle, or you may create a redirect loop.
Troubleshooting
- "Too many redirects" error: usually two HTTPS redirects working against each other, or Cloudflare set to Flexible SSL. Use only one redirect method, and set Cloudflare to Full (strict).
- Still seeing the old page: clear your browser cache or try a private window.
