How to force HTTPS on your website

This guide shows how to make every visitor land on the https:// version of your website, so the padlock shows and nobody sees a “Not secure” warning.

Before you start

Your site needs a working SSL certificate first. We issue free Let’s Encrypt certificates and renew them automatically. Visit https://yourdomain.co.uk in your browser. If you see a padlock, you’re ready. If not, see how to install a free SSL certificate.

Only use one of the redirect methods below. Using more than one can cause a redirect loop.

Option 1: the cPanel switch

1. Log in to cPanel. See how to log in to cPanel.
2. In the Domains section, click Domains.
3. Find your domain in the list.
4. Turn on the Force HTTPS Redirect switch next to it.

Repeat for any other domains on your account. If the switch is greyed out, the domain doesn’t have a valid certificate yet.

Option 2: an .htaccess rule

Use this if you want more control, or if the cPanel switch isn’t available.

1. In cPanel, open File Manager and go to public_html.
2. Click Settings at the top right and tick Show Hidden Files, then click Save.
3. Right-click .htaccess and choose Edit. If there isn’t one, click + File and create it.
4. Add these lines at the very top of the file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

5. Click Save Changes and test the site using http:// at the start.

WordPress sites

WordPress also needs to know its own address uses https://.

1. Log in to WordPress and go to Settings, then General.
2. Change both WordPress Address (URL) and Site Address (URL) to start with https://.
3. Click Save Changes. You’ll be logged out and need to log in again.

If you can’t get into the dashboard, see how to change your WordPress site address.

Fix mixed content

Sometimes the page loads over https:// but the padlock is missing or shows a warning. This is called mixed content. The page itself is secure, but some images, scripts or stylesheets are still being loaded from http:// addresses.

• In your browser, right-click the page, choose Inspect and open the Console tab. Mixed content warnings list the exact files.
• Update those links to https://. In WordPress, they are often inside posts, theme settings or page builder content.
• On WordPress, a search and replace plugin can change http://yourdomain.co.uk to https://yourdomain.co.uk throughout the database. Take a backup first.

If it doesn’t work

• “Too many redirects” error. You probably have two redirects fighting each other. See how to fix too many redirects.
• Certificate warning instead of a padlock. The certificate may not cover the address you’re using, such as www. Check it under SSL/TLS Status in cPanel.
• Changes don’t seem to apply. Clear your browser cache, or try a private window.

Still stuck? Open a support ticket and we’ll help.