# Enabling HTTPS and SSL for WordPress sites

> Secure your WordPress site with HTTPS by installing an SSL certificate, updating your site URLs and redirecting HTTP traffic.

Source: https://helpcenter.ruachost.com/wordpress/guides/enabling-https-and-ssl-for-wordpress-sites/

Securing your WordPress site with **HTTPS and SSL** ensures that all data exchanged between your visitors and your server is encrypted. On **ruachost.com**, enabling SSL is straightforward and highly recommended for security, trust, and SEO.

## Why Enable HTTPS and SSL?

- Encrypts communication between browser and server.
- Protects sensitive data (logins, payments, forms).
- Improves SEO rankings (Google favors HTTPS sites).
- Displays the padlock icon in browsers, boosting visitor trust.

## Step 1: Obtain an SSL Certificate

You need an SSL certificate before enabling HTTPS. Options include:

- **Free SSL (Let’s Encrypt)** → Available on most ruachost.com  hosting plans.
- **Commercial SSL** → Purchased from providers like DigiCert or GeoTrust for advanced validation (EV, wildcard, multi‑domain).

Install the certificate via your hosting control panel (cPanel or Plesk).

## Step 2: Enable HTTPS in WordPress

1. **Log in to WordPress** as an administrator.
2. Go to **Settings → General**.
3. Update both fields:

   - **WordPress Address (URL)** → `https://yourdomain.com`
   - **Site Address (URL)** → `https://yourdomain.com`
4. Save changes.

## Step 3: Force HTTPS Redirects

To ensure all traffic uses HTTPS:

```

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

```

- Add the following to your `.htaccess` file (for Apache servers):
- Or configure redirects in **cPanel**.
- Alternatively, use the **Really Simple SSL plugin** to automate redirects.

## Step 4: Test the Configuration

1. Visit your site at `https://yourdomain.com`.
2. Look for the **padlock icon** in the browser bar.
3. If missing, check for:

   - **Mixed content** (HTTP resources on HTTPS pages).
   - **SSL misconfiguration** (certificate mismatch).

Use Why No Padlock to troubleshoot.

## Important Notes

- Mixed content errors must be fixed by updating image, script, or CSS URLs to HTTPS.
- Some plugins may require reconfiguration after enabling SSL.
- Always back up your site before making changes.