Forcing HTTPS and Fixing Mixed Content Warnings Print

Once your certificate is installed, redirect all traffic to HTTPS and remove any remaining insecure requests.

Force HTTPS from cPanel

In cPanel, open Domains and switch on Force HTTPS Redirect for the domain. This is the simplest method and needs no file editing.

Force HTTPS with .htaccess

Add this at the very top of public_html/.htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Back up the file before editing it.

WordPress

1. Set both the WordPress Address and Site Address to https:// under Settings → General.
2. Run a search-and-replace across the database to change http://yourdomain.com to https://yourdomain.com. Use a plugin such as Better Search Replace — never edit URLs by hand in phpMyAdmin.
3. Clear all caches, including any CDN cache.

Mixed content warnings

The padlock disappears when a secure page loads an insecure resource. To find them, open the page, press F12 and read the Console — each blocked resource is listed with its URL. Typical causes:

• Images and PDFs linked with http:// in old posts
• Hard-coded script or stylesheet URLs in a theme
• Third-party embeds served over HTTP

Fix the URLs at source, or change them with the search-and-replace step above.

Verify

Test the domain with an SSL checker such as SSL Labs, and confirm that http://, www and non-www versions all end up on the same HTTPS URL.