Migrating your WordPress site to HTTPS is essential for SEO, speed, and trust—but doing it wrong can break your site or affect your rankings.

Here’s a zero-downtime migration strategy used across enterprise and publisher sites we’ve worked with. Follow these steps to upgrade to HTTPS safely, without disrupting your live environment.

Step 1: Set up a staging environment

Modifying a live production server directly during an HTTPS migration poses a high risk. Instead, create a staging environment – a complete replica of your production site – for a zero-downtime transition. Here’s why:

Tip: Do not assume your staging environment perfectly mirrors production. Verify its integrity before starting. Perform a full data comparison to ensure 100% parity between staging and production.

Step 2: Obtain and install your SSL certificate (on staging!)

Before anything else, secure your SSL certificate. The process varies depending on your hosting provider, but generally involves three steps to set up ssl certificate on WordPress​:

1. Generate a CSR (Certificate Signing Request)

Your hosting provider will typically provide tools or instructions for generating a CSR within your control panel.  The CSR contains information about your domain and organization, and it includes the public key that will be associated with your certificate. A private key is also generated during this process, keep this private key secure, as you’ll need it for installation.

2. Purchase or obtain an SSL certificate

You have several options

Hosting provider

Many WordPress hosting companies offer SSL certificates as part of their service, often with a simplified installation process.  Check your hosting provider’s documentation for details.

Certificate Authority (CA)

If your hosting doesn’t offer certificates, you can purchase one directly from a CA like GoDaddy, GlobalSign, or Comodo. CAs offer various certificate types, including:

Let’s Encrypt

Let’s Encrypt provides free SSL certificates and is a popular option for many sites. You can use certbot to get a Let’s Encrypt certificate.

For EasyEngine Users, obtaining and installing a Let’s Encrypt certificate is simplified to a single command:


			ee site update example.com --ssl=le

(Replace `example.com` with your actual domain name.)

DNS-Based Validation and Propagation

When using DNS-based validation (for DV certificates or Let’s Encrypt’s DNS-01 challenge or wildcard certificate/DNS based certificate in EasyEngine), you’ll need to add a specific TXT record to your domain’s DNS settings. After adding the record, it can take some time for the change to propagate across the internet. This is known as DNS propagation. While propagation is often relatively fast (minutes to a few hours), it can sometimes take up to 24-48 hours. During this time, the certificate authority might not be able to verify your domain control, delaying certificate issuance.

3. Install the certificate

Follow your hosting provider’s specific instructions or, if you purchased from a CA, their provided documentation. This usually involves:

Step 3: Configure WordPress using wp-config.php

While plugins are available to manage the transition to HTTPS, for better control and to minimize potential plugin conflicts or overhead, we recommend directly modifying the wp-config.php file. This approach provides granular control and reduces dependencies. Remember to perform these steps on your staging environment.

Here’s the recommended procedure:

  1. Connect to your server: Use SSH or SFTP to access your server files.
  2. Locate wp-config.php: This file is generally located in the root directory of your WordPress installation or one level above the root directory.
  3. Edit wp-config.php: Open the file with a text editor.  Add the following lines above the /* That's all, stop editing! Happy blogging. */ line:

			define('WP_HOME','https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fyour-domain.com%26%2339;);
define('WP_SITEURL','https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fyour-domain.com%26%2339;);

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' ) {
    $_SERVER['HTTPS'] = 'on';
}

Replace your-domain.com with your actual staging domain name.

Step 4: Database updates: replacing HTTP with HTTPS

Even after configuring wp-config.php, your WordPress database will likely contain hardcoded HTTP URLs within post content, image URLs, and other data.  These URLs need to be systematically replaced with their HTTPS equivalents. Always perform these steps on your staging environment first.

Back up your database before proceeding!

Before making any changes to your database, creating a backup is absolutely essential. This ensures you have a restore point in case of unexpected issues. You have several options for backing up your staging database:


			wp db export backup.sql

This command will create a SQL file (backup.sql in this example) containing your entire staging database. You can then use wp db import to restore the database if needed.

Choose the method that best suits your technical expertise and your hosting environment. The most important thing is to have a verified, restorable backup before proceeding with the database updates.

Database search and replace (recommended method: WP-CLI)

For large databases or for greater control and reliability, we strongly recommend using the WP-CLI command-line tool:


			wp search-replace 'http://your-staging-domain.com' 'https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fyour-staging-domain.com%26%2339; --dry-run --report-changed-only --skip-columns=guid

Execute the replacement

Once you’ve verified the dry-run output and are confident in the changes, remove the –dry-run flag and execute the command:


			wp search-replace 'http://your-staging-domain.com' 'https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fyour-staging-domain.com%26%2339; --skip-columns=guid --report-changed-only

Note: If you removed --skip-columns=guid during the dry run, remove it here as well.

Alternative (for smaller sites or without WP-CLI access)

If you’re working with a smaller site or don’t have access to WP-CLI, you can use a WordPress plugin like Better Search Replace. Always back up your database before using any search and replace plugin.

Step 5: Implementing redirects to force HTTPS connections

Even after configuring WordPress for HTTPS, some requests might still attempt to access your site via HTTP. To ensure all traffic uses HTTPS, we need to implement 301 redirects. The method for doing this depends on your web server software: Nginx or Apache. Always implement these changes on your staging environment first.

1. Nginx configuration

If your site is running on an Nginx web server, you’ll need to modify your Nginx configuration file (usually located at /etc/nginx/sites-available/your-site or /etc/nginx/conf.d/your-site.conf).  Add a new server block to redirect HTTP traffic to HTTPS:


			server {
    listen 80;
    server_name your-domain.com www.your-domain.com;
    return 301 https://$host$request_uri;
}

# Existing HTTPS server block
server {
    listen 443 ssl;
    server_name your-domain.com www.your-domain.com;
 #... rest of your HTTPS configuration ...
}

		


			sudo nginx -t # Test the configuration for syntax errors
sudo systemctl reload nginx

# Alternatively, if you’re not using systemctl:
sudo service nginx restart

2. Apache configuration (.htaccess)

If your site is running on an Apache web server, you’ll need to modify your .htaccess file:

  1. Edit your .htaccess file: This file is located in the root of your WordPress installation.
  2. Add the following code above any existing WordPress rules:

			<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

This code checks if the connection is not HTTPS (%{HTTPS} off) and, if so, redirects it to the HTTPS version using a 301 (permanent) redirect.

3. WordPress plugin (simplified approach)

If you’re not comfortable modifying server configuration files, or if you prefer a simpler approach, you can use a WordPress plugin to handle the HTTP to HTTPS redirection. A popular and reliable option is Really Simple Security formerly know as Really Simple SSL.

Install and activate the Really Simple Security plugin from the WordPress plugin directory. It has option for 301 redirect via PHP or .htaccess.

Caution: While plugins simplify the process, they can add overhead and might not be as efficient as server-level redirects (Nginx or Apache).

Why 301 Redirects? 301 redirects are crucial for SEO. They inform search engines that the page has permanently moved to the HTTPS URL, preserving your existing search engine rankings and ensuring that users are directed to the secure version of your site.

Step 6: Fixing mixed content issues on WordPress

Mixed content occurs when your HTTPS page loads resources (images, scripts, stylesheets) over HTTP.  Browsers will flag this as insecure, and some resources might not load at all. Below step shows how to fix mixed content in WordPress​.

Finding mixed content in WordPress

Fixing mixed content in WordPress without plugin

Using a plugin (as a last resort):  Plugins like Really Simple Security can help, but they might not catch everything, and they can add overhead. We prefer manual fixes for better control.

Step 7: Testing, deployment, and post-migration monitoring

Once you’ve completed the previous steps (SSL certificate installation, WordPress configuration, database updates, and redirect implementation), thoroughly tested your staging site, and confirmed that everything is working correctly with a green padlock in the browser address bar, you can remove the WP_HOME and WP_SITEURL constants that were temporarily added to your wp-config.php file in Step 2. Remove (or comment out) the following lines:


			define('WP_HOME','https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fyour-domain.com%26%2339;);
define('WP_SITEURL','https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fyour-domain.com%26%2339;);

Why remove these constants?

While these constants are useful for forcing HTTPS during the migration process, they are generally not recommended for long-term use. WordPress can usually determine the correct site URL automatically. Removing these constants after the migration ensures greater flexibility and avoids potential issues if your site’s URL structure changes in the future. If, at some point, the database values for siteurl and home are changed, and these constants are present, the constants will take precedence. This can cause the site to be inaccessible until the constants are removed.

Comprehensive staging site testing

Before deploying to your live site, thoroughly test every aspect of your staging environment. This includes:

Back up your live database

Once you’re 100% confident in your staging environment, create a full backup of your live database. This is a critical safety measure before making any changes to your production site.

Replicate changes on your live server

Carefully replicate all the changes you made on your staging environment to your live server, from step 1 to step 5.

Update your CDN (if applicable)

If you’re using a Content Delivery Network (CDN), you’ll need to update its configuration to ensure it serves content over HTTPS. The specific steps will vary depending on your CDN provider, but generally involve:

Post-migration monitoring

After deploying the changes to your live site, closely monitor its performance and functionality. Use monitoring tools such as:

Ensure a successful HTTPS migration

Migrating to HTTPS is essential for every WordPress site, providing critical security, SEO benefits, and enhanced user trust. By following a methodical, staging-based approach, you can ensure a smooth, hiccup-free, and zero-downtime transition. Thorough testing and a reliable rollback plan are crucial. Remember, this isn’t just about the green padlock, it’s about protecting your data and building confidence with your users.

If you need expert assistance, rtCamp’s team has extensive experience in managing successful WordPress migrations. Contact us for a secure and seamless transition.

Step 1: Set up a staging environment

Step 2: Obtain and install your SSL certificate (on staging!)

1. Generate a CSR (Certificate Signing Request)

2. Purchase or obtain an SSL certificate

3. Install the certificate

Step 3: Configure WordPress using wp-config.php

Step 4: Database updates: replacing HTTP with HTTPS

Back up your database before proceeding!

Database search and replace (recommended method: WP-CLI)

Execute the replacement

Step 5: Implementing redirects to force HTTPS connections

1. Nginx configuration

2. Apache configuration (.htaccess)

3. WordPress plugin (simplified approach)

Step 6: Fixing mixed content issues on WordPress

Finding mixed content in WordPress

Fixing mixed content in WordPress without plugin

Step 7: Testing, deployment, and post-migration monitoring

Comprehensive staging site testing

Back up your live database

Replicate changes on your live server

Update your CDN (if applicable)

Post-migration monitoring

Ensure a successful HTTPS migration

On this page

https, ssl

Credits

Riddhesh

Riddhesh Sanghvi

Author

Riddhesh Sanghvi

Author

VIEW PROFILE

Related articles

Comments

Leave a Reply Cancel reply

Name*

Email*

Comment*

Submit

Δ