Force HTTPS and clear mixed content

Step 1: Confirm the certificate covers what you use

Load the site with https:// explicitly. A certificate issued for example.com may not cover www.example.com unless both were requested. If you use both, both need to be on the certificate.

Step 2: Redirect http to https at the server

Do it once, at the server or in .htaccess, rather than in a plugin. A plugin redirect runs after PHP has started, which is slower and stops working the moment the plugin is disabled.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Step 3: Find the mixed content

Open the browser console on a few pages. Anything reported as blocked or insecure is a resource still requested over http — usually an image URL hardcoded in the database, an embedded font, or a script from a third party.

Step 4: Fix the database references properly

WordPress stores some settings as serialised data, where a naive find-and-replace corrupts the value and breaks widgets. Use a tool that understands serialisation, or ask us to run it.

Step 5: Only then consider HSTS

HSTS tells browsers to refuse http for your domain in future. It is the right end state and it is hard to undo — a browser that has seen the header will honour it for the max-age you set. Turn it on once everything genuinely works over https, not before.