When to use this guide
- The site loads over HTTP (no redirect to HTTPS)
- Mixed content warnings in the browser (some resources load over HTTP)
- The SSL/TLS certificate is expired or about to expire
- Certificate renewal is not automated
How urgent is this? HTTPS is high priority. Without it, all traffic between the visitor and the server is unencrypted and can be intercepted. This is especially critical for sites handling donations or personal data. Fix this before any other web security issue.
Who does this?
The person responsible for the organisation's hosting account. This requires access to the hosting control panel and/or the website's content management system (CMS).
Background: what does HTTPS protect?
| Concept | What it does |
|---|---|
| SSL/TLS certificate | Encrypts traffic between the visitor's browser and the server |
| HTTPS redirect | Ensures visitors are always sent to the secure version of the site |
| Mixed content | Occurs when an HTTPS page loads resources (images, scripts) over HTTP — browsers block or warn about these |
| Certificate renewal | Certificates expire (typically after 90 days for Let's Encrypt) — automation prevents accidental expiry |
Step 1: Check whether HTTPS is active
Visit the site in a browser and check:
- Does the URL show
https://? - Is there a padlock icon in the address bar?
- Does
http://[yourdomain]redirect tohttps://[yourdomain]?
If the site already loads over HTTPS with no warnings, proceed to Step 2. If not, enable SSL/TLS in your hosting control panel — most providers (including SiteGround) offer free Let's Encrypt certificates that can be activated with one click.
Step 2: Force HTTPS in WordPress
Even if HTTPS is active, WordPress may still serve some pages over HTTP. Fix this in two places:
In WordPress Settings: go to Settings → General and make sure both the WordPress Address and Site Address start with
https://.In SiteGround: go to Site Tools → Security → HTTPS Enforce and enable it. This adds a server-level redirect from HTTP to HTTPS.
Step 3: Fix mixed content
Mixed content occurs when an HTTPS page loads resources over HTTP. Check for it using the free tool Why No Padlock — enter the domain and it will list any HTTP resources.
Common fixes:
- Update hardcoded
http://URLs in the WordPress database using a plugin like Better Search Replace - Install Really Simple SSL — it automatically fixes most mixed content issues
Step 4: Automate certificate renewal
Let's Encrypt certificates expire after 90 days. Most hosting providers (including SiteGround) renew them automatically. Verify this is enabled in your hosting control panel.
If renewal is not automated, set a calendar reminder to renew manually at least 30 days before expiry. Check the expiry date at SSL Labs .
Step 5: Verification
- Visit the site and confirm the padlock is shown and the URL is
https:// - Run a full check at SSL Labs — aim for grade A or higher
- Re-run Why No Padlock to confirm no mixed content remains