WordPress HTTPS Redirect with .htaccess: Safe Setup Guide

Quick Answer

If you need to force HTTPS in WordPress, first confirm that the SSL certificate is valid.

For a non-www site, add this rule above the standard WordPress block:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
</IfModule>

Replace example.com with your real domain.

The rule sends HTTP traffic to HTTPS while keeping the requested page path.

1. Check the SSL Certificate First

Open the HTTPS version of your site directly:

https://example.com

The page should load without a browser security warning.

Check that the certificate is valid and covers the hostname you plan to use.

Your SSL certificate must work before you add the redirect. An .htaccess rule cannot fix an expired or incorrectly configured certificate.

Certificates are issued or validated by a certificate authority, so fix certificate problems at the hosting or SSL level first.

2. Check the WordPress URLs

In the WordPress dashboard, open Settings → General.

Check:

• WordPress Address (URL)
• Site Address (URL)

For a non-www site, both values normally use:

https://example.com

This keeps HTTPS on your WordPress site consistent with the server redirect.

Check wp-config.php

Some sites define their URLs in wp-config.php.

Look for:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

If these values exist, make sure they match the final HTTPS hostname.

3. Back Up the .htaccess File

Always make a backup before editing .htaccess.

1. Open your hosting File Manager.
2. Open the WordPress root directory.
3. Enable hidden files if needed.
4. Find .htaccess.
5. Download a backup copy.

If the new rule causes a 500 Internal Server Error, restore the original file.

For troubleshooting, see the SupportSolved WordPress 500 error guide.

4. Choose www or Non-www

Choose one final version of your domain:

• https://example.com
• https://www.example.com

Neither version has a direct SEO advantage.

What matters is consistency. WordPress URLs, internal links, canonical tags, your sitemap, and redirect rules should use the same version.

5. Add the WordPress .htaccess Redirect

A WordPress htaccess redirect should normally be placed above:

# BEGIN WordPress

Redirect to HTTPS Without www

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
</IfModule>

Redirect to HTTPS With www

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L]
</IfModule>

Use only one rule. Replace example.com with your own domain.

This is a common method for a WordPress redirect HTTP to HTTPS setup on Apache and LiteSpeed.

A 301 response tells browsers and search engines that the HTTPS version is permanent.

6. Fix Common HTTPS Redirect Errors

ERR_TOO_MANY_REDIRECTS

A redirect loop usually means that more than one system is handling the same request.

Check for:

• WordPress using www while .htaccess uses non-www.
• A WordPress plugin also forcing HTTPS.
• Your hosting panel already redirecting HTTP traffic.
• Cloudflare using Flexible SSL.
• An older redirect rule still being active.

Try to use one clear redirect method instead of several overlapping rules.

If you use Cloudflare and your origin has a valid certificate, Full (Strict) is usually the preferred SSL mode.

See Cloudflare’s Full (Strict) documentation.

7. Verify Every Version of Your Domain

After enabling the redirect, test all common versions of the domain.

• http://example.com
• http://www.example.com
• https://example.com
• https://www.example.com

Only your preferred HTTPS version should remain as the final URL.

The other versions should redirect to it with a 301 response.

To test one URL:

curl -I http://example.com/sample-page/

To inspect the full redirect chain:

curl -IL http://example.com

Avoid unnecessary redirect chains. Ideally, an HTTP request should reach the final HTTPS URL in one redirect.

8. Fix Mixed Content After Enabling HTTPS

The redirect only handles incoming requests. It does not update old HTTP URLs stored in WordPress.

Mixed content can come from:

• Images
• CSS files
• JavaScript files
• Fonts
• Iframes
• Theme files
• Plugin files

Clear your WordPress and CDN caches first. Then open the browser developer Console and check for resources that still load over HTTP.

If WP-CLI is available, test a database replacement:

wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run

Create a database backup before removing --dry-run.

See the official WP-CLI documentation.

9. Check WordPress SEO Settings After the Redirect

After moving the site to HTTPS, check that WordPress and your SEO plugin use the final HTTPS URLs.

• Canonical URLs should use HTTPS.
• Your XML sitemap should contain HTTPS URLs.
• Internal links should point directly to HTTPS pages.
• Images and media URLs should not use HTTP.
• Google Search Console should contain the correct HTTPS property.

Direct HTTPS links reduce unnecessary redirects and make the preferred version clearer to search engines.

You should also keep the 301 redirects active. Removing them too early can send users and crawlers back to old HTTP addresses.

Frequently Asked Questions

Summary

A reliable WordPress HTTPS redirect starts with a valid SSL certificate and one consistent domain format.

Back up .htaccess, add the correct 301 rule, and test every HTTP and HTTPS version of your domain.

If you see a redirect loop, check WordPress, your hosting panel, plugins, and Cloudflare for duplicate rules.

If HTTPS works but the browser still shows a security warning, check the site for mixed-content URLs.

Finally, confirm that canonical URLs, your sitemap, internal links, and Google Search Console all use the preferred HTTPS version.

For more troubleshooting articles, visit the SupportSolved WordPress guides.

You can also review Google’s redirect guidance.