For some time now, it has been a standard practice to provide websites with an SSL certificate and to encrypt connections to the web server accordingly. This applies not only to online stores but to all websites, including WordPress sites.
Why HTTPS at all?
There are several reasons for this:
- Google has announced that it will prioritize websites with SSL in search results
- Most browsers mark websites without SSL as insecure—this can cause uncertainty for visitors
If you already have a WordPress website without HTTPS, you should consider performing an upgrade—after all, SSL certificates are usually free today (e.g., Let’s Encrypt). However, it is up to the provider to enable the setup of a certificate.
In WordPress, the transition is not difficult, yet it is not exactly intuitive. In the “Settings” > “General” section, there is the option to define the WordPress URL (WordPress installation URL) and the Site Address (the address as it is called in the browser). I will not go into detail about why there are two URLs; I assume that the setting is simply correct and that both lines contain the same thing, e.g., http://www.my-website.tld.
Simply changing HTTPS instead of HTTP in the WordPress settings is not enough
Anyone who simply writes https://www.my-website.tld instead of http://www.my-website.tld will not be happy. This change actually only replaces the two entries in the database. All other links, such as links to media, are not changed. So, do not do it!
Perhaps a plugin can help?
In fact, there are plugins that can help you, such as the free plugin “Really Simple SSL.” The beauty of this plugin (as the name suggests) is its simplicity. Once installed and activated, it checks whether the SSL certificate is set up and offers to change the website to HTTPS with one click. If necessary, you can also set up the function in the plugin settings to automatically forward HTTP to HTTPS, and you have basically solved the problem.
Advantages and disadvantages of the plugin solution
- Advantage: Really Simple SSL is quick and easy to set up (and costs nothing). As a user, you do not actually need any special knowledge.
- Disadvantage: A plugin is used where one is not actually required.
HTTP to HTTPS with WP-CLI
The more correct method for switching a WordPress website to HTTPS is to rewrite all links in the database. To ensure that serialized database content does not break, you should not perform the rewriting simply on an SQL dump using search & replace. For this, there is WP-CLI: with WP-CLI, a search & replace can be executed directly on the live database.
To use WP-CLI, the provider must offer SSH access to the WordPress instance. Once logged in via SSH and in the root directory, you can execute this command:
wp search-replace --all-tables-with-prefix "http://www.meine-website.tld" "https://www.meine-website.tld"If you are “root,” then the call must be supplemented with “sudo -u
sudo -u <user> wp search-replace --all-tables-with-prefix "http://www.meine-website.tld" "https://www.meine-website.tld"In some cases, this variant must also be executed:
wp search-replace --all-tables "http://www.meine-website.tld" "https://www.meine-website.tld"This option is for cases where links in all tables need to be replaced, including those that may not belong to the installation.
More information on the options for the wp search-replace call can be found here:
https://developer.wordpress.org/cli/commands/search-replace/
Attention: Before you replace any links, you should create a backup of your WordPress website.
Do you need help with your WordPress site? We keep WordPress up to date and secure and help when things get stuck. More about WordPress Support