SSL and HTTPS for WordPress

Symptoms

The WordPress admin is reachable over https, the front page sometimes is, but the padlock disappears, the whole site folds to http, or the browser warns. A redirect loop (ERR_TOO_MANY_REDIRECTS) makes the whole site unreachable, and on internal pages some assets fail while the home page looks fine. The pattern is consistent: one part of the site has the https switch on, another has not, and mixed-content URLs quietly point at images and scripts loaded over http.

The cause chain

WordPress stores its full site URLs in the database (wp_options, siteurl and home) and in every post, custom field, and gallery reference. When a certificate covers the domain but those stored URLs stay http://, WordPress generates https pages that load http assets (mixed content) and produces links without the certificate on them. The typical second cause is hosting stack: the certificate is active, but no server rule converts inbound http, so visitors shuffle between the two. When the certificate exists at the edge (e.g. Cloudflare Flexible) the origin keeps redirecting toward https while something else sends back http, and that produces the endless redirect loop.

The repair steps

1. Install and run the certificate first. On most hosts that is a panel toggle (AutoSSL/cPanel) or certbot. Confirm https://example.com opens clean with a padlock before touching WordPress.
2. In the WordPress admin, set both General settings to https://: Site Address (URL) and WordPress Address (URL). Save. WordPress then rebuilds every canonical URL.
3. Force the redirect at one layer only. Add to themes/.../functions.php or a mu-plugin the permanent redirection, or use a well-known security plugin. The cleanest is a web server level 301 for inbound http (see the redirect article), because the plugin approach adds PHP overhead to every http request.
4. Fix mixed content: run a plugin search-and-replace (e.g. Better Search Replace or the CLI wp search-replace), from http://example.com to https://example.com across the database, keys excluded (option_name excluded). Platforms: wp search-replace 'http://example.com' 'https://example.com' --all-tables --skip-columns=guid (or BackWPup first).
5. Clear every cache: WordPress page cache plugin, object cache (Redis), CDN cache, and browser. Stale caches keep serving the http version of pages long after DB edits.
6. Retest public endpoints: curl -I https://example.com and curl -I http://example.com should both do https-only, and curl -kIL https://example.com shows 200 without redirect turns.

Common remaining failures

| Symptom | Because | Fix |

| ERR_TOO_MANY_REDIRECTS cleanly at https:// | Plugin conflict or Flex/Full mismatch at proxy | Bypass cache/CDN, disable plugins one at a time, set Cloudflare Full (strict) when origin has a cert |

| Padlock still missing on a few pages | Mixed content in the theme, widgets, or embeds | Same search-replace, then reload, then check the console for the http URLs |

| Pages contain http:// after --all | Some content lives in transients or object cache | Fill the object cache (redis, apc), re-run, clear again |

| Links look right but the admin breaks | Site URL vs home value disagreement | Set both to https, then use the settings screen (not wp_options) |

The WordPress > proxies traps

• Cloudflare Flexible should be retired the day the origin has a real certificate, otherwise the origin's own https redirect sees http from the proxy and runs in place.
• Two separate "force https" plugins both firing produce a loop; keep exactly one.
• Subdomain installs: if the site lives at blog.example.com rather than apex, the redirect must target https://blog.example.com, not the apex.

Prevention

• Migrate to https once via the redirect that WordPress itself cannot loop, e.g. a 301 in the web server edge, and keep the proxy mode aligned.
• Disable plugins that double the job, and check for http strings on a crawler before assuming done.
• Update WP_HOME/WP_SITEURL in wp-config.php instead of the database when possible, to prevent a future http drift.

The redirect article details the single-hop rule; the SSL errors article covers every browser certificate message.