Before changing the WordPress address
Confirm that the correct domain has a valid TLS certificate and that HTTPS works at the hosting layer. Keep a private file/database backup and a recovery route before changing URLs. HTTPS protects the connection; it does not prove a business or page is honest.
Investigate mixed content
Use the browser’s security and network tools to identify the actual HTTP resource. Confirm that its HTTPS version exists and is the intended file before changing the reference. Do not replace every HTTP string in the database blindly: it can affect external references and serialised data.
Check redirects and proxy handling
A redirect loop can result when the application and proxy disagree about the original request scheme. Have the host verify the trusted proxy configuration and WordPress setup. Do not trust an arbitrary forwarded header or paste a server-specific snippet into every installation.
If you lose access
Record the exact symptom and use the approved recovery route for that installation. The database table prefix and the relationship between the WordPress Address and Site Address vary. Do not assume that one hard-coded options-table edit is correct for every site.
Verify the result
Check representative pages, images, admin access, canonical output and direct redirects. A browser icon’s appearance varies by version; it is not a complete test. Never ignore a certificate warning just to make a page load.
For a scoped diagnosis, see our WordPress support service. Guidance checked 26 October 2026: WordPress’s HTTPS documentation.
