Every WordPress site should run on HTTPS. Browsers mark plain HTTP pages as “Not secure”, search engines prefer HTTPS, and anything typed into a form, from passwords to card details, should never travel unencrypted.
The good news is that SSL certificates no longer cost anything. The slightly less good news is that switching a site to HTTPS often leaves behind “mixed content”, which quietly breaks the padlock. Here is how both work.
How free SSL works
An SSL certificate proves to a browser that it is really talking to your domain, and lets the two encrypt everything between them.
Free certificates come from certificate authorities such as Let’s Encrypt. Before issuing one, they check that you control the domain, usually by asking your server to answer a challenge over HTTP. If it answers correctly, a certificate is issued in seconds.
Two things to know about free certificates:
- They are short-lived. A Let’s Encrypt certificate lasts 90 days, so it must be renewed automatically. Set it up once, and make sure renewal really runs.
- They are just as secure as paid certificates for a normal website. The encryption is the same. Paid certificates mainly add extra identity checks or support.
Most control panels and many hosts issue and renew free certificates for you. On your own VPS, a tool like Certbot can do it, or your server panel can.
Switching a WordPress site to HTTPS
Once a certificate is installed:
- Change the site address. In Settings → General, set both “WordPress Address” and “Site Address” to start with
https://. - Redirect HTTP to HTTPS at the web server, with a permanent (301) redirect, so old links and bookmarks still work and search engines move their rankings across.
- Update links inside your content. Old posts still contain
http://links to your own images and pages. That is where mixed content comes from.
What mixed content is
Mixed content happens when a page loads over HTTPS, but something inside it, such as an image, a script, a stylesheet or a font, still loads over plain HTTP.
Browsers handle it in two ways:
- Scripts, stylesheets and iframes over HTTP are blocked outright. Parts of the page may stop working or lose their styling.
- Images, audio and video are either upgraded to HTTPS automatically or load with a warning, and the padlock may disappear or show a warning.
Either way, visitors see a site that looks broken or less trustworthy.
Finding mixed content
- The browser console. Open your browser’s developer tools on the page and look at the console. Mixed content is reported line by line, with the exact URL that caused it.
- Check more than the home page. Old posts, widgets, the footer and pages built years ago are the usual hiding places.
- Theme and plugin settings. Logos, background images and custom code saved in settings often contain hard-coded
http://addresses.
Fixing it
- Your own URLs in the database: replace
http://yourdomain.comwithhttps://yourdomain.comacross the database. Use a WordPress-aware tool, such as WP-CLI’ssearch-replacecommand, rather than a plain find-and-replace on an export. WordPress stores some settings in a format that breaks if text length changes. Take a backup first. - Hard-coded links in your theme: edit the theme or child theme files, or better, use relative or protocol-correct links.
- External resources: if a third-party script or image is only available over HTTP, find an HTTPS version or replace it. If it cannot be served securely in 2026, it should probably not be on your site.
Once the database is updated, clear every cache, including your page cache and any CDN, so visitors get the fixed pages.
Keep it working
- Check that renewal runs well before expiry. A certificate that expires takes the whole site offline with a browser warning.
- After the switch has been stable for a while, consider enabling HSTS, which tells browsers to always use HTTPS for your domain.
- When you add new domains or subdomains, such as a staging site, make sure they get certificates too. We covered staging in what is a WordPress staging site.
Where Rubuz fits
Rubuz issues a free SSL certificate for every site it runs, and renews it automatically, so there is nothing to remember. It works on any VPS you connect, from any provider.