WordPress Tutorial Series

WordPress SSL Setup: A Complete Guide from Certificate to HTTPS

WordPress SSL Setup: A Complete Guide from Certificate to HTTPS

—

by

startwordpress
in

Overview

Securing your WordPress site with SSL is a multi-step process that moves beyond the WordPress dashboard into server management. This tutorial provides a complete, server-aware guide to setting up an SSL certificate, covering everything from generating a Certificate Signing Request (CSR) and choosing a domain validation method to installing the certificate on your web server and finally configuring WordPress to force HTTPS site-wide.

Why Does WordPress Require SSL Beyond a Plugin?

An SSL certificate encrypts data between a visitor's browser and your server, which is essential for protecting login credentials, user information, and transaction data. Beyond security, Google uses HTTPS as a ranking signal, and modern browsers actively warn visitors about "Not Secure" sites, which can severely damage trust. While some managed hosts offer automated SSL, understanding the underlying process is critical for custom setups, wildcard certificates, or troubleshooting.

Pre-Setup Checklist: What You Need Before Starting

Before you begin the installation, gather these prerequisites to ensure a smooth process:

  • Server Access: You need SSH or panel access (like BaoTa, cPanel, or DirectAdmin) to your WordPress server to generate keys and install the certificate.
  • Domain Control: The ability to manage DNS records for your domain or access the email address listed in your domain's WHOIS registrant record.
  • Certificate Information: You must have purchased or ordered an SSL certificate. Ensure the certificate type matches your needs (e.g., single-domain, wildcard for *.yourdomain.com).
  • CSR Generation Tool: Access to OpenSSL via the command line or a server panel tool.

Choosing Your SSL Validation Method: A Decision Framework

The certificate authority (CA) must verify you control the domain through Domain Control Validation (DCV). Your choice impacts speed and required steps. The following framework is based on standard validation methods:

Validation Method How It Works Best For Estimated Time
Email Validation CA sends a verification link/code to an administrative email (e.g., admin@yourdomain.com or the WHOIS registrant email). Quick setup for users with accessible domain-based email. Within minutes
DNS Validation You add a specific TXT or CNAME record to your domain's DNS settings. Users comfortable with DNS management; essential for wildcard certificates. After DNS propagation (minutes to hours)
HTTP/HTTPS Validation You upload a specific verification file to the root directory of your website. Users with immediate file access to the web root via FTP or panel. After file upload and confirmation

Critical Note: For email validation, the receiving email address must be either a domain-based email address or the exact registrant email from the WHOIS record. You must complete all validation steps yourself. For a detailed walkthrough of each method, see the SSL Certificate Validation Methods Guide.

Step-by-Step SSL Installation Guide

Step 1: Generate a CSR and Private Key

The Certificate Signing Request (CSR) is a block of encoded text containing your details and public key. The CA uses it to create your certificate.

Using a Server Panel (e.g., BaoTa):

  1. Log in to your BaoTa panel.
  2. Navigate to Website > SSL.
  3. Select the domain you are securing.
  4. Click Apply for Certificate. The panel will automate CSR generation.
  5. Securely copy and save both the generated CSR text and your private key.

Using Command Line (Linux):

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

Follow the prompts to enter your domain (Common Name), organization details, etc. Keep the .key (private key) file extremely secure and never share it.

Step 2: Submit CSR and Complete Domain Validation

Submit the CSR text to your certificate provider. You will then choose and complete your DCV method as outlined in the framework above.

Example: DNS Validation Process

  1. In your provider's dashboard, select DNS Validation.
  2. The CA provides a specific TXT record (e.g., Name: _acme-challenge.yourdomain.com, Value: [a long verification code]).
  3. Log in to your domain registrar's DNS management console.
  4. Add the TXT record exactly as specified.
  5. Wait for DNS propagation, then return to the CA's page and click "Check" or "Verify" to complete validation.

Step 3: Install the Certificate on Your Web Server

Once the certificate is issued, download the certificate files (typically yourdomain.crt and a CA bundle file).

Using BaoTa Panel:

  1. In the SSL section, go to the Other Certificate (PEM) tab.
  2. Paste the contents of your certificate file (.crt) and the CA bundle into the respective boxes.
  3. Paste your saved private key into the Private Key box.
  4. Click Save and enable HTTPS for the site. The panel will configure the web server automatically.

Using Command Line (Nginx Example): Combine your certificate and bundle: cat yourdomain.crt yourdomain.ca-bundle.crt > fullchain.pem. Then, update your Nginx site configuration (/etc/nginx/sites-available/yourdomain.conf):

server {
 listen 443 ssl http2;
 listen [::]:443 ssl http2;
 server_name yourdomain.com www.yourdomain.com;

 ssl_certificate /path/to/fullchain.pem;
 ssl_certificate_key /path/to/yourdomain.key;

 # Strong SSL settings
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_prefer_server_ciphers off;
}

Restart Nginx: sudo systemctl reload nginx.

Post-Installation: Configuring WordPress for HTTPS

Installing the certificate is only half the task. You must now force WordPress to use it.

  1. Update WordPress URL Settings: In your WordPress dashboard, go to Settings > General. Change both the WordPress Address (URL) and Site Address (URL) to begin with instead of .
  2. Force HTTPS Redirect: Configure your server to redirect all HTTP traffic to HTTPS. An Apache .htaccess rule is:
 RewriteEngine On
 RewriteCond %{HTTPS} off
 RewriteRule ^(.*)$ [L,R=301]

For Nginx, a redirect block in your server configuration will be similar.

  1. Scan for Mixed Content: After forcing HTTPS, use your browser's developer tools (F12 > Console) or an online tool to scan for "mixed content" warnings (HTTP resources on an HTTPS page). A plugin like "Really Simple SSL" can help fix many common database-based issues automatically.

Troubleshooting Common WordPress SSL Issues

Even with correct installation, issues can arise. Use this checklist to diagnose common problems:

  • "Not Secure" Warning in Browser: Verify the certificate is correctly installed and not expired using an SSL checker. Ensure you have forced HTTPS in WordPress settings and via a server redirect.
  • Mixed Content Errors: These occur when images, scripts, or stylesheets are loaded over HTTP. Use the browser console to identify the insecure resources and update their URLs in your database, theme, or plugin files to use `.
  • Redirect Loops: This often happens if the redirect rule is misconfigured or if a plugin is conflicting with the server redirect. Check your .htaccess or server config and temporarily disable SSL plugins to isolate the issue.
  • Subdomains Not Securing: If you use a standard single-domain SSL, it will not cover subdomains. You need either a wildcard SSL certificate or a separate certificate for each subdomain.

Conclusion

Completing a WordPress SSL setup involves a precise sequence: generating a CSR, passing domain validation, installing the certificate at the server level, and finally configuring WordPress to operate fully on HTTPS. Mastering this process ensures your site is secure, trusted by visitors, and optimized for search engines. If managing these technical steps feels complex, choosing a hosting provider that simplifies or automates SSL management can provide significant peace of mind and save valuable time.

Frequently Asked Questions

Can I use a free Let's Encrypt SSL certificate with WordPress?

Yes, absolutely. Let's Encrypt certificates are free, automated, and trusted by all major browsers. They are an excellent choice for most standard WordPress websites, and many hosting panels offer one-click installation and auto-renewal.

What is the difference between a standard SSL and a wildcard SSL for WordPress?

A standard SSL certificate secures a single domain (e.g., www.yourdomain.com). A wildcard SSL certificate (*.yourdomain.com) secures your main domain and all of its first-level subdomains (e.g., shop.yourdomain.com, blog.yourdomain.com). Wildcard certificates almost always require DNS validation.

I installed the SSL certificate but WordPress shows "Not Secure." What's wrong?

This is typically due to "mixed content"—some files (images, scripts, stylesheets) on your pages are still being loaded over HTTP. Open your browser's developer console (F12) to see the insecure resources, then update those links in your database or theme files to use `. A plugin can often automate this repair.

Do I need a different SSL certificate for each WordPress site I own?

Yes, unless the sites are subdomains of the same primary domain covered by a single wildcard certificate. For separate, unrelated domains like site1.com and site2.org, you need a distinct certificate for each one.

How do I fix a "redirect loop" after installing SSL?

A redirect loop often means both WordPress and your server are trying to redirect the user repeatedly. Disable any SSL-related plugins first to check for conflicts. Then, verify your server's redirect rule (in .htaccess or Nginx config) is not incorrectly configured. Ensure your WordPress URL settings use ` and that there are no conflicting rules in your site's configuration files.