Ultimate 3-Step WordPress HTTPS Redirect via .htaccess (2025 Guide)
Still seeing http:// on your WordPress site? You’re not alone. Enforcing HTTPS is critical for SEO, trust, and data protection. In this guide, we’ll show you exactly how to create a WordPress HTTPS redirect using the .htaccess file in under 5 minutes.
Why Use HTTPS on WordPress?
Without HTTPS, data between your website and visitors is sent in plain text, which is risky. Search engines now prioritize secure websites. A WordPress HTTPS redirect ensures all traffic goes to the secure version of your site.
Step 1: Locate Your .htaccess File
Log in via FTP or your hosting panel (like cPanel or Plesk), then go to the root of your WordPress site—typically public_html or www. Locate the .htaccess file.
Can’t find it? Enable “show hidden files” in your file manager settings.
Step 2: Add Redirect Rule
Open your .htaccess file in a text editor and insert the following code at the very top:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
This rule checks if HTTPS is off and redirects to the secure version of your URL with a 301 (permanent) status.
Step 3: Save and Verify
Save the changes and visit your site using http://. If the redirect is configured correctly, you should be sent to the https:// version automatically.
Alternative: Use a Plugin (If You Must)
If you prefer not to edit files, you can install Really Simple SSL. However, adding the redirect in .htaccess is leaner and avoids extra plugin overhead.
Extra Tips for HTTPS Redirect
- Ensure your SSL certificate is valid and active.
- Test for mixed content with WhyNoPadlock.
- If you use Cloudflare, enable Full SSL and Automatic HTTPS Rewrites.
- Update internal links and media URLs from
http://tohttps://using Better Search Replace.
For more WordPress optimization tips, visit our WordPress category.
Final Thoughts
Configuring a WordPress HTTPS redirect via .htaccess is the cleanest and fastest way to secure your website. It takes minutes and improves SEO, user trust, and overall security—without needing plugins.
