How to Force HTTPS on Your WordPress Site

Good news: if your site is hosted with a cPanel account, you likely already have an SSL certificate installed. Every SA Webhosts hosting package includes a free SSL certificate, issued and renewed automatically via AutoSSL, at no extra cost or setup on your end.

But having a certificate installed isn't the same as having a secure site. Unless you explicitly force it, your WordPress site will happily load over both https://yoursite.co.za and the unencrypted http://yoursite.co.za — and browsers, search engines, and visitors will all treat those as two different, inconsistent versions of your site.

Here's how to close that gap and make sure your site only ever opens with the https:// prefix.

1. Update Your WordPress Address Settings

Start inside WordPress itself:

• Go to Settings → General in your dashboard.
• Change both the WordPress Address (URL) and Site Address (URL) fields from http:// to https://.
• Save changes.

This tells WordPress to generate its internal links, stylesheets, and scripts using HTTPS by default. It's a necessary step, but on its own it won't stop someone from typing the http:// version and loading an unencrypted page — you still need a redirect to catch that.

2. Force HTTPS via .htaccess (Most Common on cPanel/Apache)

Since cPanel hosting runs on Apache, this is the most reliable and lightweight way to force HTTPS. Add the following to the very top of your .htaccess file, found in your WordPress root directory and accessible via cPanel's File Manager:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

A few tips:

• Place this above the default WordPress block (between # BEGIN WordPress and # END WordPress) so it takes effect first.
• R=301 marks the redirect as permanent, which is what search engines want — it tells them the HTTP version has moved for good, not temporarily.
• Download a backup copy of your existing .htaccess before editing, in case something needs to be reverted.

This method is fast because the redirect happens at the server level, before WordPress even has to load.

3. Force HTTPS with a Plugin

If you'd rather not touch .htaccess directly, a plugin will do the same job through the WordPress dashboard:

• Really Simple SSL — the most widely used option. It detects your existing certificate, forces HTTPS automatically, and fixes common mixed-content issues along the way.
• WP Force SSL — similar functionality with a few extra settings for handling specific pages differently.

This is the easiest route if you're not comfortable editing server files, though it adds a small amount of overhead since WordPress has to load before the plugin can redirect.

4. Fix Mixed Content Warnings

Once HTTPS is being forced, check for "mixed content" warnings — these happen when old posts, widgets, or theme files still reference images or scripts using hardcoded http:// links, even though the page itself now loads securely.

• Use a plugin like Better Search Replace to update any leftover http:// references stored in your database to https://.
• Check your theme's custom code (e.g. functions.php) for hardcoded HTTP URLs.
• Reload a few key pages with your browser's developer console open and look for any mixed-content errors.

Which Method Should You Use?

For most cPanel-hosted WordPress sites — including SA Webhosts packages — the combination of updating your WordPress address settings and adding the .htaccess redirect is all you need: it's fast, doesn't rely on a plugin, and enforces HTTPS at the server level before WordPress even loads. If you'd rather manage it entirely from the WordPress dashboard without editing server files, a plugin achieves the same result with a bit less setup.

Either way, once it's in place, your site will only ever open with the https:// prefix — no mixed versions, no unencrypted pages, and no manual redirect to remember.

Not sure whether your certificate is active, or want a hand setting up the redirect? Get in touch and we'll sort it out for you.