How to: Enforce HTTPS and automate SSL/TLS renewal

How to: Enforce HTTPS and automate SSL/TLS renewal

When to use this guide

Use this guide when  securityheaders.com  or a manual check shows any of:
  • The site loads over HTTP (no redirect to HTTPS)
  • Mixed content warnings in the browser (some resources load over HTTP)
  • The SSL/TLS certificate is expired or about to expire
  • Certificate renewal is not automated
How urgent is this? HTTPS is high priority. Without it, all traffic between the visitor and the server is unencrypted and can be intercepted. This is especially critical for sites handling donations or personal data. Fix this before any other web security issue.

Who does this?

The person responsible for the organisation's hosting account. This requires access to the hosting control panel and/or the website's content management system (CMS).


Background: what does HTTPS protect?

Concept
What it does
SSL/TLS certificate
Encrypts traffic between the visitor's browser and the server
HTTPS redirect
Ensures visitors are always sent to the secure version of the site
Mixed content
Occurs when an HTTPS page loads resources (images, scripts) over HTTP — browsers block or warn about these
Certificate renewal
Certificates expire (typically after 90 days for Let's Encrypt) — automation prevents accidental expiry


Step 1: Check whether HTTPS is active

Visit the site in a browser and check:
  • Does the URL show https:// ?
  • Is there a padlock icon in the address bar?
  • Does http://[yourdomain] redirect to https://[yourdomain] ?
If the site already loads over HTTPS with no warnings, proceed to Step 2. If not, enable SSL/TLS in your hosting control panel — most providers (including SiteGround) offer free Let's Encrypt certificates that can be activated with one click.


Step 2: Force HTTPS in WordPress

Even if HTTPS is active, WordPress may still serve some pages over HTTP. Fix this in two places:
In WordPress Settings: go to Settings → General and make sure both the WordPress Address and Site Address start with https://.
In SiteGround: go to Site Tools → Security → HTTPS Enforce and enable it. This adds a server-level redirect from HTTP to HTTPS.


Step 3: Fix mixed content

Mixed content occurs when an HTTPS page loads resources over HTTP. Check for it using the free tool  Why No Padlock  — enter the domain and it will list any HTTP resources.
Common fixes:
  • Update hardcoded http:// URLs in the WordPress database using a plugin like Better Search Replace
  • Install Really Simple SSL — it automatically fixes most mixed content issues


Step 4: Automate certificate renewal

Let's Encrypt certificates expire after 90 days. Most hosting providers (including SiteGround) renew them automatically. Verify this is enabled in your hosting control panel.
If renewal is not automated, set a calendar reminder to renew manually at least 30 days before expiry. Check the expiry date at  SSL Labs .


Step 5: Verification

  • Visit the site and confirm the padlock is shown and the URL is https://
  • Run a full check at  SSL Labs  — aim for grade A or higher
  • Re-run  Why No Padlock  to confirm no mixed content remains