WordPress SSL guide
SSL Certificates for WordPress: Which One You Need and How to Install It
Most WordPress sites only need a domain-validated certificate – free from the host or paid from a CA. This guide shows which SSL certificate fits your WordPress site, how to install it and how to switch to HTTPS without breaking anything.
Choosing an SSL certificate for WordPress
An SSL certificate for WordPress is the same certificate any website uses: a small data file, issued by a certificate authority (CA), that lets browsers load your site over HTTPS. WordPress itself does not care which brand you pick. For most blogs, business sites and small shops, a domain-validated certificate is enough, and many hosts include one for free.
You buy a certificate when the free one stops fitting: you want your company name inside the certificate, you run several sites or subdomains, or your host does not let you install a free certificate on every environment. The rest of this guide helps you choose, install and update the certificate, then switch WordPress to HTTPS cleanly.
| Key fact | What it means for WordPress (as of October 2026) |
|---|---|
| Validation level | DV (domain control only) suits most sites; OV and EV add verified company details. Encryption strength is identical. |
| Where it is installed | On the web server or hosting panel – not inside WordPress. Plugins only help WordPress use HTTPS. |
| Certificate lifetime | Public certificates are valid for at most 200 days since 15 March 2026, so renewals or reissues come round more often. |
| WordPress settings | WordPress Address (URL) and Site Address (URL) must both start with https://. |
| Main risk when switching | Mixed content and redirect loops – both avoidable with the checks below. |
Get a DV certificate for your WordPress site
Compare low-cost domain-validated certificates from Sectigo, RapidSSL, GeoTrust and Thawte with live prices.
Compare DV SSL certificatesDo you need to buy an SSL certificate if your host offers free SSL?
No, not always. If your host issues and renews a free certificate automatically for every domain you run, that certificate encrypts traffic exactly as well as a paid DV certificate. Paying makes sense when you need something the free option does not give you.
Free certificates from hosts are usually domain-validated, issued per domain and tied to that host’s automation. Move hosts, add a staging copy on another server or put a CDN in front, and you may lose that automation. For the full comparison of support, warranty and validation options, see our guide to free vs paid SSL.
| Host SSL is enough if… | Buy a certificate if… |
|---|---|
| Your host renews it automatically and you never touch it | You want your verified company name in the certificate (OV or EV) |
| You run one site on one domain | You run staging and live on different servers or hosts |
| You do not need CA support or a warranty | You manage several WordPress sites or many subdomains under one certificate |
| Your host allows HTTPS on every domain you use | Your host blocks free certificates or charges to enable them |
Which SSL certificate is best for WordPress?
The best SSL certificate for WordPress is the one that covers all your hostnames at the validation level you need. Brand matters less than coverage: a single blog needs a single-domain certificate, while a WordPress Multisite with subdomains needs a wildcard.
For most sites, domain validated (DV) SSL is the right starting point. You prove control of the domain by email, DNS record or an uploaded file, and the CA issues the certificate without paperwork. If you searched for a “WP instant SSL certificate”, a DV certificate is the closest match, because it skips organization checks.
| Your WordPress setup | Certificate type | Why |
|---|---|---|
| One blog or brochure site | Single-domain DV | Covers example.com and usually www.example.com |
| Multisite with subdomains (shop.example.com, blog.example.com) | Wildcard SSL | One certificate for all first-level subdomains |
| Several WordPress sites on different domains | Multi-domain SSL | One certificate lists each domain |
| Company site where identity matters | OV or EV | Verified organization name visible in the certificate details |
Popular DV certificates for WordPress
Best value Comodo
Comodo PositiveSSL
- Domain Validation (DV)
- Issued in minutes
- Covers domain and www
from $7.20 / year
Fast issuance Sectigo
Sectigo SSL
- Domain Validation (DV)
- Issued in minutes
- $500,000 warranty
from $51.80 / year
Best value RapidSSL
RapidSSL Certificate
- Domain Validation (DV)
- Issued in minutes
- DigiCert-backed brand
from $13.33 / year
How to install an SSL certificate on WordPress
You install an SSL certificate on WordPress in two layers: first on the server through your hosting panel, then inside WordPress by switching both site URLs to https://. WordPress cannot install a certificate by itself; it only uses the HTTPS connection the server provides.
Route 1: through your hosting panel
Most WordPress hosts have an SSL or “Security” section. For a free certificate you switch it on. For a certificate you bought, you create a CSR (certificate signing request – the file with your domain and public key that you send to the CA), complete validation, then paste the issued certificate and its intermediate chain into the panel. Server-level steps for Apache, Nginx, IIS and other platforms are covered when you install an SSL certificate.
Route 2: with a plugin
SSL helper plugins (for example Really Simple SSL) do not replace the certificate. They detect an existing certificate, update the site URLs, add redirects and rewrite insecure links. Use them only after the certificate is live on the server, and remove extra redirect rules if your host already forces HTTPS.
Tip: Locked out of the dashboard after changing the URLs? Set them inwp-config.phpinstead:define( 'WP_HOME', 'https://example.com' );anddefine( 'WP_SITEURL', 'https://example.com' );
Switch WordPress to HTTPS in four steps
Confirm the certificate works
Open https://yourdomain.com in a private window. The padlock must show without warnings before you change anything in WordPress.
Back up first
Take a full backup of files and database. If a URL change locks you out, you can restore it quickly.
Update both site URLs
In Settings → General, change WordPress Address (URL) and Site Address (URL) to https://. Or use Tools → Site Health, which offers a one-click HTTPS switch (WordPress 5.7 and later) when your server supports HTTPS.
Redirect and re-check
Force HTTP to HTTPS with a 301 redirect at the host or server level, clear every cache, then load key pages and check for padlock warnings.
Will HTTPS break your WordPress site?
No, HTTPS does not break a WordPress site when you prepare for three things: mixed content, hard-coded http:// links and caching or CDN settings. Each one causes a visible symptom, and each has a simple fix.
Mixed content means an HTTPS page still loads images, scripts or stylesheets over plain HTTP, so the browser drops the padlock or blocks the file. In WordPress the usual sources are old URLs stored in the database by the editor, page builders and theme options. Our step-by-step guide shows how to fix mixed content; on WordPress the core step is a database search-and-replace from http:// to https:// on your own domain, for example with WP-CLI wp search-replace, after a backup.
Redirects, canonical tags, sitemaps and Search Console are part of any site-wide switch, not just WordPress. Follow our checklist to move from HTTP to HTTPS without losing rankings.
| Symptom | Likely cause | Fix |
|---|---|---|
| Padlock missing or “Not secure” on some pages | Images or scripts still on http:// | Search-replace old URLs in the database; update theme and builder settings |
| “Too many redirects” | CDN or proxy talks to the server over HTTP while WordPress forces HTTPS | Set the CDN to full (strict) HTTPS to the origin, or tell WordPress the proxy uses HTTPS |
| Old HTTP version still shows | Page cache or CDN cache | Purge plugin, server and CDN caches after the switch |
| Locked out of wp-admin | Site URLs changed before the certificate worked | Set WP_HOME and WP_SITEURL in wp-config.php, then fix the certificate |
Fix SSL certificate errors in WordPress
Certificate name mismatch
The certificate does not list the hostname you open, often www vs non-www. Reissue it with both names or redirect to the covered one.
Expired certificate
The host’s auto-renewal failed or a paid certificate was not replaced. Renew or reissue, then install the new file.
Incomplete chain
The intermediate certificate is missing, so some browsers and apps reject the site. Paste the full CA bundle into the hosting panel.
Tip: After any fix, test the live site with our SSL checker. It shows the hostnames, expiry date and chain the server actually sends, so you can see whether the problem is the certificate or WordPress itself. For error messages in other browsers and servers, see common SSL errors and fixes.
Which SSL certificate is best for a WooCommerce store?
A DV certificate is technically sufficient for WooCommerce, because it encrypts checkout and account pages just as strongly as OV or EV. Choose OV or EV when you want your verified business name in the certificate, which some customers and B2B buyers check.
Card payments add a compliance layer. PCI DSS, the card industry’s security standard, requires strong encryption when cardholder data travels over public networks; it does not prescribe DV, OV or EV. Many WooCommerce stores send card entry to the payment provider’s hosted fields, which reduces what your own server handles. Store-specific advice on checkout, scans and trust signals is in our guide to SSL for ecommerce stores.
| Store situation | Good fit |
|---|---|
| New or small WooCommerce shop, card entry handled by the payment provider | DV – lowest effort, same encryption |
| Registered business that wants its name shown in the certificate | OV |
| Established brand, high-value orders, strict procurement checks | EV – most extensive vetting (no green address bar since 2019; details appear in the certificate viewer) |
How to update or renew the SSL certificate on WordPress
You update an SSL certificate on WordPress by replacing it on the server, not in WordPress. Free host certificates renew automatically; a paid certificate needs a new issuance (renewal or reissue) and a new upload in the hosting panel before the old one expires.
Because the maximum lifetime of a public certificate is 200 days as of October 2026 (and drops to 100 days from 15 March 2027), plan for replacements within your plan term. Set a calendar reminder or use your host’s auto-install feature if it supports third-party certificates. If you also compare WordPress hosting with SSL certificate included, check whether the host lets you upload your own certificate – not every managed WordPress host does.
- Order the renewal or reissue and complete domain validation.
- Install the new certificate and chain in the hosting panel.
- Purge caches and confirm the new expiry date with a certificate check.
- No change in WordPress settings is needed if the domain stays the same.
Secure your WordPress site with a DV certificate
Pick a domain-validated certificate, validate by email, DNS or file, and install it through your hosting panel.
Shop DV SSL certificates