Force HTTPS on a WordPress site

Redirect every request to HTTPS without creating a redirect loop.

Once the certificate is active, send all traffic to HTTPS. Do it in one place — the platform — rather than in a plugin as well.

Turn it on

Sites → your site → Settings → Force HTTPS. The redirect happens at the edge, before PHP runs, so it costs nothing in performance.

Fix the site URL

WordPress still stores the address it was installed with. Update both values:

wp option get siteurl
wp option update siteurl 'https://example.com'
wp option update home 'https://example.com'

HSTS

HSTS tells browsers to refuse plain HTTP for your domain in future. Enable it only when HTTPS works everywhere, including every subdomain, because the policy is cached by browsers for months and cannot be withdrawn quickly.