Why Does My WordPress Site Need HTTPS, Not Just HTTP?

Why This Isn't Optional Anymore

HTTPS was once considered primarily relevant for sites handling sensitive data directly, but browser vendors and search engines have both moved to treat it as a baseline expectation for any site. Chrome and other major browsers now display an explicit "Not Secure" warning in the address bar for any page served over plain HTTP, which erodes visitor trust immediately and visibly, regardless of what the page actually does.

The Concrete Reasons It Matters

• Data encryption in transit protects login credentials, form submissions, and any other data a visitor sends from being intercepted by anyone positioned between them and the server (an unsecured public WiFi network, for instance).
• Browser security warnings on plain HTTP pages are increasingly prominent and visible, actively discouraging visitors from proceeding, particularly on any page with a form.
• Search engine ranking factors include HTTPS as a positive signal, meaning a plain HTTP site is at a genuine, if modest, SEO disadvantage compared to an HTTPS equivalent.
• Payment processing requirements mandate HTTPS outright — no payment gateway will process transactions over an unencrypted connection, making it a hard technical requirement for any ecommerce functionality.
• Free SSL certificates (Let's Encrypt, and similar) have made the cost barrier to HTTPS essentially disappear, removing what used to be a legitimate reason to delay adoption.

Setting Up HTTPS

1. Obtain and install an SSL certificate, often free and automated through the hosting provider.
2. Update WordPress's Site Address and WordPress Address settings to use HTTPS.
3. Set up 301 redirects from HTTP to HTTPS for every URL, and fix any mixed-content warnings that surface afterward.

Moving an existing site to HTTPS cleanly

1. Install the certificate and confirm it covers both the bare domain and the www version. Many hosts offer this as a one-click option.
2. Update the addresses. Change WordPress Address and Site Address in Settings → General to start with https://.
3. Replace old http:// URLs in the database, using a tool that handles serialized data, so images, widgets and settings all move across.
4. Redirect all HTTP traffic to HTTPS with a 301 at the server level, and check that canonical tags, the sitemap and internal links use the HTTPS address.
5. Update connected services: add the HTTPS version as a property in Search Console and analytics, and update payment-gateway return and webhook URLs.
6. Check for mixed content in the browser console on key pages.

Renewals and HSTS

Free certificates are short-lived and must renew automatically, so confirm renewal works and watch the expiry date. An expired certificate shows visitors a full-page browser warning. Consider HSTS only after everything is confirmed working, because browsers remember it and it is hard to undo.

Need help migrating to HTTPS or fixing mixed-content issues? See WordPress bug fix.