Move A WordPress Site To HTTPS – WPQuickies

In this lunchtime #WPQuickies, I take a quick look at the best ways to move a WordPress website from HTTP to encrytped, safe and secure HTTPS.

WordPress Going HTTPS #WPQuickies webinar

In this webinar I cover the following topics.

What is SSL and HTTPS?

SSL stands for Secure Socket Layer which adds a layer of encryption to communications between your browser and a web server.  Turning plain readable HTTP requests into secure encrypted HTTPS communications making it much harder for anyone to snoop in on the data you are sending.

This is done by adding an SSL certificate to your web browser.  The SSL certificate is linked to the domain name of your website,

It comes in the form of a key pair – private and public which is validated by a trusted certificate authority.

Any site trying to spoof over HTTPS from a dodgy CA will be flagged by all the major web browsers.

Read more about CA’s at https://en.wikipedia.org/wiki/Certificate_authority

Why do you need SSL and HTTPS?

Firstly, I think it makes sense to encrypt data so that nobody can snoop, read and steal it.

Think about all that personal information your website is dealing with, emails, phone numbers, shipping addresses and credit card information – you don’t want make that information easy to get at for hackers and fraudsters.

Secondly, having a secure website has been proven to be a significant signal in the Google ranking algorithm.  Nowadays it’s a must to have your entire website running securely.

The last reason you should move your site over to HTTPS is that as of 2018/2019 Chrome, Firefox and Safari started marking HTTP pages as “not secure”.  You don’t want your customers seeing a not secure warning flash up on your site. That will destroy credibility and trust.

Where do I get an SSL certificate from?

You can get an SSL from your web hosting provider.

You should never pay for an SSL as the organisation Let’s Encrypt offers free SSL certificates for anyone and there are Let’s Encrypt modules built in to cPanel and  Plesk which handle all the technical details.

If you hosting provider is asking you to pay for an SSL certificate  – maybe you should be looking around for another provider.

If they do support Let’s Encrypt, you can request an SSL certificate yourself using cPanel or Plesk without having to contact your hosting provider – just follow the instructions.  It works for single domains, sub domains and wildcard domains.

Setting up WordPress with SSL/HTTPS

The subject of SSL/HTTPS may be complex but setting up your WP site to use HTTPS isn’t magick.

Of course you need to setup and install the SSL certificate on your web hosting account before you can progress to this part.

For beginners, the best way of converting your site to HTTPS is to use a plugin such as Really Simple SSL
https://wordpress.org/plugins/really-simple-ssl/

The free version translates HTTP requests to HTTPS in real-time.  Paid version can sort out issues such as mixed content where your theme or a plugin is generating HTTP URLs instead of HTTPS.

Mixed content warnings are quite common if you’re trying to translate HTTP into HTTPS on the fly or if a theme/plugin developer isn’t properly detecting the protocol of the site – that’s the HTTP/S part.

Search the page source code for HTTP using the browser inspector and find the theme or plugin which is generating that URL, then open a support request with the developer.

Manually

If you want to actually change the content of the database from HTTP to HTTPS – use the plugin Better Search Replace.
https://wordpress.org/plugins/better-search-replace/

Yes, it’s over 1 year old but it works perfectly.

Enter HTTP then HTTPS url and replace data.

Go to Settings > General: Change HTTP to HTTPS url

Add this to the wp-config.php file:
define('FORCE_SSL_ADMIN', true);

Update Google Search Console

You will need to update your Google Search Console and add the new HTTPS address of your site as Google treats HTTP and HTTPS urls as separate entities.

Open the search console at
https://search.google.com/search-console/about

Go ahead and click on Add Property and type in your HTTPS website URL.

Lastly you want to update your Google Analytics because Google Analytics treats http and https urls as different entities.

Navigate to https://analytics.google.com/

Go to Admin > Property Settings > Basic Settings

Change Default URL to https://

Watch More #WPQuickies

You can watch more #WPQuickies from the playlist on our WordPress Sydney YouTube channel.

The playlist is also embedded below, click the hamburger menu in the top right of the video to see the others in the series.

Suggest a #WPQuickies Topic

If you have an WordPress topic you’d like to see explained in 30 mins or under, fill out the form below.

https://forms.gle/mMWCNd3L2cyDFBA57

Keep In Touch

Wil

Wil is a dad, consultant, developer, conference organiser, speaker and business mentor. He co-organizes the WordPress Sydney meetup group and has been on the orgnising committee for WordCamp Sydney since 2014. He speaks at many technical events and contributes to the WordPress open source project. His likes are chillies, craft beer and electrogravitics.

Leave a Comment

Your email address will not be published. Required fields are marked *