- Article
- 2 minutes read
- Reviewed August 4, 2026
HTTPS encrypts traffic between a user’s browser and the website.
It protects credentials, cookies and content from interception or modification in transit. It does not secure vulnerable code or compromised accounts.
TLS Certificate and Hostname
The certificate must be valid for every public hostname used by the site.
Configure renewal monitoring and ensure that expired or mismatched certificates do not interrupt access.
WordPress URLs
Site Address and WordPress Address should use the intended HTTPS hostname.
Update internal URLs and redirects during migration. Mixed HTTP and HTTPS values can create login loops, insecure resources and duplicate URLs.
Force Secure Administration
FORCE_SSL_ADMIN can require login and administration sessions over HTTPS when the server is configured correctly.
It must be set in wp-config.php, not a normal plugin.
Reverse Proxies
A CDN or reverse proxy may terminate TLS before forwarding traffic to WordPress.
Configure trusted proxy headers and HTTPS detection correctly. Incorrect detection can create infinite redirects or insecure cookies.
Mixed Content
A secure page that loads images, scripts or styles over HTTP can trigger browser warnings or blocked resources.
Search the database, theme, CSS, widgets and plugin settings for old HTTP references.
HTTP Security Headers
Headers such as HSTS can strengthen HTTPS enforcement but should be introduced carefully.
Test certificates, subdomains and redirects before enabling long-lived policies.
Frequently Asked Questions
Does HTTPS stop malware?
No. It protects network transport.
Can a free certificate be secure?
Yes. Security depends on correct issuance, configuration and renewal rather than price alone.
Continue Learning
Previous: [Roles, Capabilities and Access Control](/resources/wordpress-manual/security/roles-capabilities-access-control/)
Next: [WordPress File and Directory Permissions](/resources/wordpress-manual/security/file-directory-permissions/)