Move WordPress from HTTP to HTTPS and Strengthen with WP Ghost HSTS

Your site needs an SSL certificate and HTTPS before WP Ghost’s (formerly Hide My WP Ghost) HSTS security header can do its job. Move WordPress to HTTPS first, then add the header in WP Ghost.

Why HTTPS matters for WordPress security

HTTPS encrypts the connection between your visitors’ browsers and your server. Without it, login credentials, form submissions and payment data travel in plain text. Browsers mark HTTP sites as “Not Secure”, Google uses HTTPS as a ranking signal, and payment processors like Stripe and PayPal require SSL.

How to move WordPress to HTTPS

Get an SSL certificate

Most hosting providers include free SSL certificates (via Let’s Encrypt) with every plan. Check your hosting control panel for a “SSL/TLS” or “Security” section. If your host does not offer free SSL, you can purchase a certificate from your domain registrar or a dedicated SSL provider and ask your host to install it.

Update WordPress URLs to HTTPS

After your SSL certificate is active, go to Settings > General in your WordPress dashboard. Change both the WordPress Address (URL) and Site Address (URL) fields from http:// to https://. Click Save Changes. WordPress will log you out. Log back in using the new https URL.

Set up HTTP to HTTPS redirects

You need a 301 redirect so all HTTP traffic goes to HTTPS. The simplest approach is to use a plugin like Really Simple SSL, which handles the redirect and mixed content fixes automatically. WP Ghost is fully compatible with Really Simple SSL. After installing it, save its settings, then re-save WP Ghost settings so the .htaccess rules load in the right order.

Alternatively, add this to your .htaccess file manually (Apache servers):

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

For Nginx servers, add this to your server block:

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://example.com$request_uri;
}

Replace example.com with your own domain.

Fix mixed content errors

After switching to HTTPS, some images, scripts, or stylesheets may still load over HTTP. This causes “mixed content” warnings and prevents the padlock icon from appearing. Use the browser DevTools Console (F12) to identify which resources still load over HTTP. Fix them by updating URLs in your database with a search-and-replace plugin (search for http://example.com, replace with https://example.com). Really Simple SSL handles most mixed content automatically.

Strengthen HTTPS with WP Ghost security headers

A certificate encrypts the connection; it doesn’t stop a browser from making its first request over HTTP. WP Ghost adds the Strict-Transport-Security (HSTS) header, which tells browsers to use HTTPS for your domain every time. Without HSTS, an attacker on the same network could intercept that first HTTP request before the 301 redirect fires.

Go to WP Ghost > Firewall > Header Security. Switch on Add Security Headers against XSS and Injection Attacks and click Save.

The header list starts with Strict-Transport-Security (HSTS) and Content-Security-Policy, and the Add Security Header button adds others such as X-Frame-Options and X-Content-Type-Options. For each header and how to customize CSP, see the Header Security tutorial.

Verify your headers are active by visiting SecurityHeaders.com and entering your domain.

Frequently asked questions

Does WP Ghost have its own SSL redirect feature?

No. WP Ghost does not include a dedicated SSL redirect. It relies on your hosting, a plugin like Really Simple SSL, or Cloudflare to handle the HTTP to HTTPS redirect. WP Ghost’s HSTS header complements the redirect by telling browsers to always use HTTPS after the first visit.

Do I need to re-save WP Ghost settings after setting up Really Simple SSL?

Yes, if Really Simple SSL modifies .htaccess. Save Really Simple SSL settings first, then re-save WP Ghost settings. That puts the rules in .htaccess in the right order. This is a one-time step unless you change Really Simple SSL’s redirect settings later.

What is the difference between SSL and HSTS?

SSL encrypts the connection. HSTS tells the browser to always use that encrypted connection. Without HSTS, the first request to your site might be over HTTP before the 301 redirect kicks in. An attacker on the same network (like public WiFi) could intercept that first request. HSTS eliminates this window by instructing the browser to never even attempt an HTTP connection.

Will switching to HTTPS affect my search rankings?

It helps. HTTPS is a confirmed Google ranking signal. After switching, add your https:// URL as a new property in Google Search Console and resubmit your sitemap. Google will transfer your rankings to the HTTPS version. The 301 redirects you set up pass the link equity to the HTTPS URLs.

Is SSL required for WooCommerce?

Yes. Every payment processor (Stripe, PayPal, Authorize.net) requires HTTPS. WooCommerce itself warns you if SSL is not active. WP Ghost is fully compatible with WooCommerce and Really Simple SSL.

Does WP Ghost modify WordPress core files?

No. Security headers are added through server configuration and PHP output. No core files are modified. Disabling removes all headers instantly.

Related tutorials

Header Security – the security headers WP Ghost can send (HSTS, CSP, X-Frame-Options and more).

Content Security Policy (CSP) – customize which sources can load content on your HTTPS pages.

WP Ghost with Really Simple SSL – compatibility guide for using both plugins together.

Firewall and Geo Security – the 2026 Ghost Firewall that protects your HTTPS endpoints.

Website Security Check – verify your overall security configuration.