WordPress Site Not Secure After Installing SSL Fix – WebFixHQ

Verify SSL Certificate Installation & Validity

WHERE to look: Use an online SSL checker tool (e.g., SSL Labs SSL Server Test) or inspect the certificate directly in your browser (click the "Not Secure" warning, then "Certificate").

WHAT to look for: Ensure the certificate is issued for your exact domain (including www if applicable), is not expired, and the full chain is correctly installed. Look for warnings like "Certificate Name Mismatch" or "Chain Issues". If you see ERR_SSL_PROTOCOL_ERROR, this is often the first place to check.

WHAT it means: If the certificate is invalid or misconfigured, no amount of WordPress-side fixing will help. This is a server-level issue that needs to be resolved with your hosting provider or by re-issuing/re-installing the certificate.

✓ 5-10 minutes. Critical first step.

Update WordPress Address in Database & wp-config.php

WHERE to look: First, check WordPress Admin > Settings > General. Ensure both "WordPress Address (URL)" and "Site Address (URL)" are set to https://yourdomain.com. If you can't access the admin or changes revert, look in your database (via phpMyAdmin or similar) in the wp_options table for siteurl and home. Also, check your wp-config.php file.

WHAT to look for: Any instance of http:// in these settings. In wp-config.php, look for lines like define('WP_HOME', 'http://yourdomain.com'); or define('WP_SITEURL', 'http://yourdomain.com');. Ensure define('FORCE_SSL_ADMIN', true); is also present and active.

WHAT it means: WordPress relies on these settings to generate URLs. If they're http://, your site will continue to serve content insecurely, causing wordpress ssl installed but site still http. Update them to https://. If defined in wp-config.php, they override database values.

// In wp-config.php, add or update these lines:
define('WP_HOME', 'https://yourdomain.com');
define('WP_SITEURL', 'https://yourdomain.com');
define('FORCE_SSL_ADMIN', true);

✓ 10-15 minutes. Always back up wp-config.php and your database first.

Implement .htaccess Redirect for HTTPS

WHERE to look: Connect via FTP/SFTP or your hosting file manager and open the .htaccess file in your WordPress root directory.

WHAT to look for: Existing redirect rules that might conflict or are missing. You need a rule that forces all http:// traffic to https://. Place this rule before the standard WordPress rewrite rules (# BEGIN WordPress).

WHAT it means: This ensures all incoming requests are immediately redirected to the secure version, preventing wordpress http to https redirect not working. If you're seeing wordpress forcing http instead of https, this file is a prime suspect.

# BEGIN Force HTTPS
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
# END Force HTTPS

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

✓ 5 minutes. Clear browser cache after updating. Incorrect rules can break your site; see WordPress Broken After Editing .htaccess for recovery.

Scan and Fix Mixed Content Issues

WHERE to look: Open your site in Chrome or Firefox, right-click, and select "Inspect" (or "Inspect Element"). Go to the "Console" tab. Look for warnings or errors indicating resources loaded over http://. These often say "Mixed Content: The page at 'https://...' was loaded over HTTPS, but requested an insecure resource 'http://...'."

WHAT to look for: Specific URLs (images, scripts, CSS files) that are still using http://. This is the classic symptom of a wordpress insecure content warning on chrome and why your wordpress padlock not showing after ssl.

WHAT it means: Even one insecure asset can break the padlock. You need to update these URLs in your database, theme files, or through a plugin. For a deep dive, refer to our dedicated guide: WordPress Mixed Content Error After SSL Migration.

✓ 15-30 minutes. Can be time-consuming depending on the number of insecure assets.

Perform a Database Search and Replace

WHERE to look: This is a database operation. Use a plugin like Better Search Replace, or WP-CLI if you have SSH access.

WHAT to look for: Instances of http://yourdomain.com that need to be replaced with https://yourdomain.com. It's crucial to replace the full domain, not just http:// with https://, to avoid issues with other domains.

WHAT it means: Many plugins and themes store absolute URLs in the database. A search and replace ensures all these references are updated, preventing persistent mixed content or redirect issues. This is often the final step to fully resolve wordpress https not working properly.

# Example using WP-CLI (replace with your actual domain)
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guid --dry-run

# Remove --dry-run after verifying the changes
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guid

✓ 10-20 minutes. ABSOLUTELY BACK UP YOUR DATABASE FIRST.