To force HTTPS in WordPress on an Apache or LiteSpeed server, add a 301 redirect rule to your .htaccess file. Every HTTP request then goes to the same URL on HTTPS, so users and search engines see one version of each page.
Install the SSL certificate first and confirm the HTTPS version loads without errors. For the full move, including mixed content, see the guide on migrating your WordPress site to HTTPS.
The .htaccess Rule to Force HTTPS
Open the .htaccess file in the WordPress root (the folder that holds wp-config.php) and add these lines at the very top, above the # BEGIN WordPress block:
# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# BEGIN WordPress
# (the rules WordPress generated stay here, unchanged)
# END WordPress
Keep it outside the WordPress markers. WordPress rewrites everything between them when permalinks are saved.
How the Rule Works
What each part does:
RewriteCond %{HTTPS} off matches requests that did not arrive over SSL/TLS. Apache sets HTTPS to on for encrypted connections.
RewriteRule ^(.*)$ matches any path and sends it to https:// plus the requested host and path. The query string is carried over automatically.
R=301 makes the redirect permanent, which tells search engines to index the HTTPS URL. Without a code, Apache sends a temporary 302. L stops the remaining rules for this request.
The rule has to run before the WordPress block. Those rules route most requests to index.php, and a redirect placed after them never fires for normal post and page URLs.
Browsers cache 301 redirects hard. While testing, use R=302, check a few URLs, then switch to R=301.
Update the WordPress URLs to HTTPS
WordPress still builds links from its own settings. Go to Settings > General and change both WordPress Address (URL) and Site Address (URL) to https://.
If those fields are greyed out, the values are defined in wp-config.php. Update them there:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );
Old http:// links in post content cause mixed content warnings. With WP-CLI you can replace them in the database (back up first, and remove --dry-run when the report looks right):
wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run
To also settle on one hostname, add the rules to redirect www to non-www (or the reverse).
Redirect Loops Behind Cloudflare, a Proxy or a Load Balancer
When SSL ends at a proxy or load balancer, the proxy talks to your server over plain HTTP. %{HTTPS} is always off, every request is redirected, and the browser shows “too many redirects”.
Check the X-Forwarded-Proto header the proxy sends instead of %{HTTPS}:
# Force HTTPS behind a proxy that sets X-Forwarded-Proto
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http [NC]
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Only rely on this header when you control the proxy and it overwrites the header on every request. The Apache documentation on forcing HTTPS covers this setup and its caveat.
WordPress also needs to know the original request was HTTPS. Add this to wp-config.php above the “That’s all, stop editing!” line:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
$_SERVER['HTTPS'] = 'on';
}
On Cloudflare, the usual cause is the Flexible SSL/TLS mode, where Cloudflare connects to your server over HTTP. Set the mode to Full (strict) with a valid certificate on the server, as described in Cloudflare’s redirect loop troubleshooting.
Nginx Does Not Read .htaccess
On Nginx, .htaccess files are ignored, so the rule above does nothing. Add a server block that listens on port 80 and redirects to HTTPS:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}
Without access to the server configuration, ask your host to add the redirect.
FAQs
Common questions about forcing HTTPS in WordPress:
Where in .htaccess should the force HTTPS rule go?
At the top of the file, above # BEGIN WordPress. Placed after the WordPress rules it never runs for post and page URLs, and placed inside the WordPress markers it gets overwritten when permalinks are saved.
Why do I get "too many redirects" after forcing HTTPS?
SSL is usually ending at a proxy such as Cloudflare, so your server sees every request as HTTP and keeps redirecting. Check X-Forwarded-Proto instead of %{HTTPS}, and on Cloudflare switch the SSL/TLS mode from Flexible to Full (strict).
Should the HTTPS redirect be a 301 or a 302?
Use a 301 for the live site, since the move to HTTPS is permanent and search engines should index the HTTPS URLs. Use a 302 while testing, because browsers cache 301 redirects.
Does the .htaccess redirect fix mixed content warnings?
No. Mixed content comes from http:// URLs inside your pages, such as images in post content. Update the WordPress Address and Site Address to HTTPS and replace old URLs in the database.