How to Add SSL To WordPress: 7 Easy Steps

Over the last two years, Google has hinted at warning Chrome browser users when they click on a website that’s non-HTTPS.

Recently, Google formally announced that it would start alerting Chrome users when they click on a non-HTTPS website beginning in early July.

For those business owners who have already installed an SSL Certificate on their WordPress sites,  this news did not upset the apple cart all too much.

However, for those business owners who have mostly shrugged off Google’s warnings, this new formal announcement is not to be taken lightly.

Google now has the attention of all business owners in regards to the importance of having an SSL, or Secure Socket Layer Certificate installed.

The good news is that while some of the rhetoric involved with HTTPS is technical jargon, the act of moving a WordPress site from HTTP to HTTPS is simple.

Let’s learn how to make a Wordpress site secure.

If you have yet to heed Google’s warnings to use an SSL Certificate, you might be asking why the heck they are so pushy over the matter.

The fact is, HTTPS upgrades the security for the web surfer. Google is not attempting to inconvenience site owners. Instead, Google wants to create a safer web surfing environment for all people.

For that to happen, site owners must take the helm and install SSL Certificates on their WordPress sites. Google is no longer asking any site owner to turn on HTTPS as a matter of good faith; rather, they are throwing down the gauntlet and saying, “no more poor security.”

SSL is a security certificate that is installed on the website that essentially renders the site to the HTTPS protocol. The terms HTTPS and SSL are often used interchangeably on the web, even if slightly inappropriately.

In simple terms, an SSL Certificate is installed on a website.

Let’s use HTTP://www.seoexpertbrad.com as an example URL. Once an SSL Certificate is installed on SEOExpertBrad.com and the technical work is accomplished to change out the URLs, SEOExpertBrad will now be both HTTPS://seoexpertbrad.com and HTTPS://www.seoexpertbrad.com.

This site has a valid SSL Certificate, so the HTTPS protocol is live.

When a website, such as this one, is on the HTTPS protocol, all data typed into forms located on that website will be encrypted through Google’s Chrome browser.

If a site has a credit card form on it, when the consumer types in their CC information, that form will become encrypted so long as the website hosting the CC form is on the HTTPS protocol.

Why does this matter?

When a consumer types data into a form on a website, hackers can, through a number of nefarious means, steal that information.

On sites that have HTTPS protocol enacted, the data is encrypted, rendering it useless for hackers.

HTTPS, by default of its ability to encrypt data on Chrome, makes these sites less attractive to hackers.

There is a downside to HTTPS, one that I am quite confident Google is working on fixing. I call it a false sense of security.

Because secure sites are recognized by consumers as safer experiences, hackers are savvily setting up their phishing schemes on HTTPS sites.

As a web surfer, it is essential to pay attention whenever you are putting personal information into any website form.

Google’s change is not a “leaps and bounds” sort of groundbreaking endeavour. The fact is, Google Chrome already displays a site’s SSL status inside of the URL. It does so by displaying a green padlock next to the words, “SECURE.”

Here’s an example of what a Google Chrome user sees when they visit a site with an active SSL Certificate.

Most website hosts will give you an easy option to install an SSL Certificate.

For example, GoDaddy dedicated hosting clients can login to their hosting management interface and purchase the SSL Certificate for $74.99 (annually).

Another way to install an SSL Certificate is through the free service, LetsEncrypt.com.

They are free. However, they do accept donations.

The good news about Let’s Encrypt is that one of their sponsors is Google Chrome, which qualifies Let’s Encrypt as a legitimate and safe service for SSL Certificates.

Unlike the case I cited regarding GoDaddy, Let’s Encrypt SSL certificates are free.

The bad news is that many web hosts, notably shared hosting services, don’t technically work with the service.

If your host does accept Let’s Encrypt certificates, you can use these easy to follow installation instructions, and you should be all set.

You will need to begin by adding a simple line into your wp-config.php file. When you open this file, there will be a line that reads, That is All, Stop Editing! You will need to add the following line BEFORE that notation.

define(‘FORCE_SSL_ADMIN’, true);

Now, go to your site’s admin using HTTPS, rather than the legacy HTTP protocol. This will be accomplished (most likely) by typing in https://yourdomain.com/wp-admin/

If the site resolves and you see the padlock, go ahead and login to your Admin. Once logged in, confirm the SSL padlock remains.

Now, your admin section is using the SSL protocol. This will help secure your admin from phishing attempts. Phishing attempts are prevalent on WordPress admin login forms because they offer a hacker credentials that access the site’s administrative portion.

That was easy (just like I said), but don’t celebrate just yet, there are a few more simple changes to make.

This is the part of converting a WordPress site to HTTPS that causes you to realize how many instances of HTTP really exist on your site.

Any audio or video files, pictures, iFrames, web fonts, Javascript, CSS, and internal linking structures, have all been affected by this significant change.

Here are two plugins that may offer some help in the matter: Velvet Blues | Search and Replace

You will want to run a massive search and replace.

Now, it is important to understand; this is the point where if things are going to go wrong, they will. Fear not, however, because you wisely backed your site up. If a massive scale URL replacement script breaks the site, you can restore the site back to its old self.

You cannot exactly go ask every site that uses your link to update their URLs, and some traffic may be serving cached versions of your old URL protocol.

Because of this, use a 301 redirect to deal with these instances and assure that they end up on the HTTPS version.

You will need to access your FTP. Turn your FTP on to “display hidden files.” Open the file titled, .htaccess. If you do not have one, create a notepad (plain text) file by the same name and upload it to the root directory in the WordPress/ folder.

You need to make an addition to the file. That is as follows:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Click SAVE.

And just like that, the world wide web is going to respect your site as HTTPS enabled.

Now, before you celebrate, go ahead and test your SSL by inputting your URL into SSL Labs (here). This will verify that your site is. Indeed, SSL enabled.

Now, the next steps are done as a way to make sure your SEO and Analytics continue to be tracked in webmaster tools.

Relax, it’s just a few easy steps to accomplish, and then you are good to go.