Force HTTPS for WordPress websites by .htaccess

Updated: 28 September 2026 · Applies to: WordPress 7.1

Make your WordPress site always use HTTPS in two steps: tell WordPress its address is https, then redirect any http visits.

1. WordPress settings

1. Log in to your WordPress dashboard (https://yourdomain.com/wp-admin).
2. Go to Settings › General.
3. Change WordPress Address (URL) and Site Address (URL) to start with https://, and save. You will be asked to log in again.

2. Redirect http to https

Add this above the # BEGIN WordPress block in .htaccess (or use cPanel's Force HTTPS Redirect in Domains › Domains):

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Tip: If some images still load over http ("mixed content"), update the old links in your content, for example with a search-and-replace plugin.