Install an SSL certificate and switch WordPress to HTTPS

Step 1: Issue a free certificate

On cPanel, open Security → SSL/TLS Status, select the domain and its www name, and run AutoSSL. Validation works by reaching the domain, so it only succeeds once DNS points at this server. A name that does not resolve here, such as www without a DNS record, is left off the certificate.

Step 2: Or install a certificate you bought

Generate the private key and certificate signing request (CSR) in the same panel, under SSL/TLS, and give the CSR to the certificate authority. When the certificate arrives, open Manage SSL sites and paste the certificate; the panel matches it to the stored key. Include the CA bundle the authority supplies, or some browsers and API clients will report the chain as untrusted.

Step 3: Check the certificate before touching WordPress

Load https://yourdomain.com and https://www.yourdomain.com. Both must open without a warning. Changing WordPress first, while the certificate is invalid, leaves you with an admin area you cannot reach without clicking through errors.

Step 4: Change both WordPress addresses

Settings → General: WordPress Address (URL) and Site Address (URL) both become https://. If the fields are greyed out, they are set in wp-config.php as WP_HOME and WP_SITEURL — change them there.

Step 5: Rewrite old http links in the content

Posts and settings still contain http:// URLs. Use WP-CLI's search-replace, which handles WordPress's serialised data correctly. Run it with --dry-run first to see how many replacements it will make.

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guid --dry-run
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guid

Step 6: If a proxy or CDN terminates HTTPS

WordPress may not see the request as secure and keep redirecting to https forever. Tell it to trust the forwarded protocol by adding this to wp-config.php, above the line that says to stop editing. Only do this when a proxy you control sits in front of the site.

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
    $_SERVER['HTTPS'] = 'on';
}

Step 7: Redirect http to https

Finish with a server-level 301 redirect and a mixed-content check, as described in the Force HTTPS tutorial.