Changing WordPress to Use HTTPS

The Trials and Tribulations of Changing WordPress to Use HTTPS

HTTPS Secure ConnectionI was looking into the possibility of changing WordPress to use https and came across this site: www.sslshopper.com. If you enter your domain in the given field it will check the SSL status of your website.

Out of idle curiosity I put in one of my sites and I was somewhat floored to find it had an active and fully functional SSL certificate. It turns out that the “Let’s Encrypt” boys had been at work!

 

First Attempt!

“OK,” I thought let’s give this a try! I have a couple of undeveloped sites and chose one of those. It had a simple HTML index page and no more. I went into CPanel and chose to let Softaculous do the installation. You get the choice of installing as http or https. In for a penny, in for a pound. So https it was. It installed flawlessly – so far so good!

There was however, more to do. You need to force visitors and spiders to use the https version of your website. You also need to let spiders know it’s a permanent redirect, so you need to add some instructions to your .htaccess file. After some research I found what I was looking for, which incidentally, was not easy. There’s a lot of conflicting instructions and information out there.

The code I placed at the very top was this:

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

I won’t pretend that this placement will definitely work for you on your server, but it worked for me.

 

Second Attempt!

Changing WordPress to HTTPSEncouraged by my success I decided to try my hand with another of my sites that was active and had content. This time the approach was slightly different as WordPress was already installed.

Firstly, you need to login to your WordPress admin section. Look for “Settings” and then “General” and click on it. You will see two fields named “WordPress Address (URL)” and “Site Address (URL).”

You will see that the URL address for both start with http. Change both to https and then save your changes.

You will then need to go into CPanel and make the same code additions as mentioned above. I did and then off I went to test my changes!

 

Uh-oh…

At first glance everything seemed hunky dory. The expected padlock indicating secure connection was there and so I went checking some of the posts and that’s when the fun began!

The first post I checked flashed up with the padlock and then changed to the standard “i” that you see on Chrome. WTF? I thought. I went back to the home page and that did the same having been secure only minutes before.

Perhaps I messed up the code in the .htaccess file? So I went back to that and spent the next hour of my life making alterations in a vain attempt to get the padlock back. Nothing I tried worked.

I remembered a snippet from years ago warning about IE and XP warnings about mixed content so gave that some thought. For those who don’t know, mixed content is when non-https media is being called by an https page.

I knew the images were OK and that all their URL’s had been correctly changed by WordPress, so what was it?

And then it dawned… I was using OIO Publisher as an ad server and when I checked I discovered that whenever a particular default ad was shown the padlock disappeared and an “i” took its place. I went into the settings and sure enough, the URL being called was the http version and not the https version. A simple change and all was well.

The site functioned perfectly.

 

The moral of the story is…

You have to think outside the box. The problem is not always what you think it is. With hindsight mixed media causing the problem was blindingly obvious, but it certainly wasn’t at the time! I really thought I had messed up the .htaccess file.

 

And Lastly

You need to log into your Google webmaster’s account and make sure you add the https version to your sites. You will have to re-verify that you own the site as Google treats it as being not owned. I always use the uploaded html page on my sites and if you do too then all you have to do is click “Verify.” Otherwise choose whatever other method you use. Once done Google will re-spider it.

Leave a Reply

20 − 19 =

Select Language