Every domain on WP Aligned hosting gets a free WordPress SSL certificate from Let's Encrypt. cPanel's AutoSSL issues it and renews it for you, so you never buy, upload or renew a certificate by hand. What AutoSSL can't do is switch WordPress itself to https://. This guide covers both halves: confirming the certificate is in place, then moving the site to HTTPS cleanly, with no mixed content warnings, no redirect loops and no stale cached pages.
www. version when that name resolves to the server.https:// work. WordPress keeps using whatever address is in its settings until you change it.You don't need a paid certificate for a normal WordPress site. A Let's Encrypt certificate is trusted by every current browser and shows the same padlock.
What the statuses mean:
In the screenshot, www.kb.wpaligned.com and mail.kb.wpaligned.com fail because no DNS record exists for them. That's harmless when the site doesn't use those names. It matters if visitors use www., because they get a certificate warning.
Take a backup before this step. Use the WP-CLI export below, or confirm JetBackup 5 in cPanel has a recent backup of the site.
http:// to https://. Keep the rest of each address exactly as it is, including www. or the lack of it.https:// address.
If those two fields are greyed out, they're set in wp-config.php as WP_HOME and WP_SITEURL. Change them there instead.
Open Advanced > Terminal in cPanel (or connect over SSH), go to the site's document root and run:
cd ~/public_html
wp db export ~/before-https.sql
wp option update home 'https://example.com'
wp option update siteurl 'https://example.com'
Replace public_html with the site's document root (shown in Domains > Domains) and example.com with the site's domain. If wp isn't found, use the full path, /usr/local/bin/wp.
Changing the site address doesn't touch content that's already saved. Image URLs, links and background images inside posts, widgets and page builder data still say http://. When a page served over https:// loads one of those files over http://, the browser calls it mixed content: it may block the file, and it drops the padlock or shows Not secure.
Fix it with a search-and-replace across the database. WP-CLI handles serialized data (the format many plugins and page builders use) safely. Always do a dry run first:
wp search-replace 'http://example.com' 'https://example.com' --all-tables-with-prefix --skip-columns=guid --dry-run --report-changed-only
The dry run lists every table and column it would change and the number of replacements. If the numbers look sensible, run it for real by removing --dry-run:
wp search-replace 'http://example.com' 'https://example.com' --all-tables-with-prefix --skip-columns=guid --report-changed-only
Notes:
--skip-columns=guid leaves each post's GUID alone. WordPress uses the GUID as a permanent ID, not a link, and changing it can make feed readers re-show old posts.example.com and www.example.com in old content, run the command once for each form.LiteSpeed has cached the http:// versions of your pages, with http:// links inside them. Purge everything so visitors get the new pages: in wp-admin, go to LiteSpeed Cache > Toolbox > Purge and click Purge All. If the site is behind Cloudflare, purge there too. See How to Clear LiteSpeed Cache on WP Aligned Hosting for the details.
Old links, bookmarks and search results still point at http://. Send all of them to https:// with a permanent redirect.
The simplest way is cPanel's built-in switch:
The switch works per domain, so turn it on for each domain and subdomain that should redirect. In our testing it took about two minutes to start redirecting, so wait a moment before you check. If the switch is greyed out, the domain doesn't have a valid certificate yet. Go back to Step 1.
If you prefer to keep the redirect with the site's files (for example, so it moves with the site to another server), add this to the top of the site's .htaccess instead. LiteSpeed reads .htaccess rewrite rules:
# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
Use one method, not both. Don't add this rule to a site that's behind Cloudflare in Flexible mode. See the Cloudflare section below.
http://example.com. It should land on https://example.com with a padlock.Mixed Content warnings. Each one names the http:// file that still needs fixing.curl -sI http://example.com/ | grep -iE '^HTTP|^location'
You want a 301 with a location: that starts with https://. If you see a chain of redirects, or the same URL redirecting to itself, see ERR_TOO_MANY_REDIRECTS below.
When a domain is proxied through Cloudflare (orange cloud), visitors get Cloudflare's certificate, and Cloudflare connects to our server separately. The setting that controls that second connection is SSL/TLS > Overview > encryption mode in the Cloudflare dashboard.
For sites on WP Aligned hosting, use Full:
http://. Once the site forces HTTPS, our server redirects that request to https://, Cloudflare asks again over http://, and the browser gives up with ERR_TOO_MANY_REDIRECTS.If you manage the site but the client owns the Cloudflare account, get access to it before you start. See DNS for what we can help with on Cloudflare.
The redirect loops instead of landing on a page. Check these in order:
www. while .htaccess sends them to the bare domain. Keep one redirect method and make sure it matches the address in Settings > General.The browser doesn't trust the certificate for the name you visited. Usually one of:
www.example.com and only example.com has a certificate, or the other way round. Add the missing DNS record so AutoSSL can cover it, or redirect to the name that works.The Status tab shows the reason. The common ones:
does not resolve to any IP addresses: there's no DNS record for that name. Add one pointing at the server, or ignore it if the site never uses that name.resolves to a different address: the name points somewhere else, often the old host or a stray AAAA (IPv6) record. Fix the DNS record. If the domain is behind Cloudflare, check its records there, not at the registrar..htaccess rule may be blocking /.well-known/acme-challenge/, the path Let's Encrypt uses to confirm the domain. Make sure nothing denies access to /.well-known/.After you fix DNS, AutoSSL picks it up on its next run. If you don't want to wait, open a ticket.
Something is still loaded over http://. The browser console names it. Typical sources are a hard-coded URL in the theme's files, a widget or menu link typed in by hand, a script embedded from a third-party service that only offers http://, or a page builder's generated CSS. Fix the source, then purge the cache.
When you migrate a site to WP Aligned, AutoSSL can't issue the certificate until DNS points at our server, and the site may show a certificate warning for the first few minutes to hours after the switch. To keep that window short, lower the DNS record's TTL a day before you move it, switch DNS, then check the Status tab and open a ticket if the certificate hasn't appeared once DNS has changed. Sites behind Cloudflare in Full mode usually don't show a warning, because visitors see Cloudflare's certificate while ours is issued.
Open a ticket if:
Include the domain and the exact message from the Status tab. See Need Help? for how to reach us.
No. AutoSSL gives every domain on WP Aligned hosting a free Let's Encrypt certificate and renews it automatically. Browsers trust it the same way they trust a paid certificate.
No. The certificate is installed on the server, and the steps above switch WordPress, fix stored URLs and force the redirect without a plugin. Plugins that rewrite http:// to https:// on every page load add work to each uncached request and hide problems you're better off fixing once in the database.
Not when the redirect is a single permanent 301 from each http:// URL to the same https:// URL, which both methods in Step 5 do. Update the site's address in Google Search Console afterwards by adding the https:// version as a property if it isn't there already.
Let's Encrypt certificates are valid for 90 days. AutoSSL renews them automatically before they expire, as long as the domain still points at our server.