How to configure SSL for WordPress

Quick answer: Issue a free Let’s Encrypt certificate with certbot (sudo certbot --nginx -d example.com -d www.example.com), then switch WordPress to HTTPS: update the two URLs in Settings → General (or wp option update), and fix mixed content with a search-replace. Renewal is automatic via systemd timer.

Overview

HTTPS is mandatory in practice — browsers flag plain HTTP, and Google uses it as a ranking signal. Let’s Encrypt certificates are free and renew automatically every 60–90 days. The WordPress-specific part people miss is updating the site URLs and cleaning up hard-coded http:// references left in content.

Before you start

• The domain’s A record already resolving to your VPS (guide) — Let’s Encrypt validates over the live domain.
• Ports 80 and 443 open in the firewall.
• WP-CLI installed for the command-line steps (optional but faster).

Step-by-step guide

1. Install certbot and issue the certificate (Nginx example):

   sudo apt install certbot python3-certbot-nginx
   sudo certbot --nginx -d example.com -d www.example.com

   Certbot edits the server block, installs the certificate and sets up the HTTP→HTTPS redirect.
2. Update the WordPress URLs:

   sudo -u www-data wp option update home 'https://example.com'
   sudo -u www-data wp option update siteurl 'https://example.com'

3. Fix mixed content (hard-coded http:// in posts and settings):

   sudo -u www-data wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid

4. Verify renewal is armed: sudo certbot renew --dry-run.
5. Test: the padlock should be clean; check remaining mixed content with the browser console or whynopadlock.com.

Common issues

• Challenge fails: DNS not propagated yet or port 80 blocked — verify with dig +short example.com and ufw status.
• Redirect loop: a page cache or proxy also forcing HTTPS — purge caches; behind Cloudflare use SSL mode “Full (strict)”.
• Padlock with warning: images or scripts still loaded over http:// — the search-replace in step 3 plus a theme/plugin settings check fixes it.

When to contact support

Certificate issuance is fully in your hands on an unmanaged VPS, but if validation keeps failing because of platform-side networking, open a ticket with the certbot error output.

Frequently asked questions

Is a Let's Encrypt certificate good enough for a business site?

Yes — it provides the same encryption strength as paid DV certificates and is trusted by all browsers. Paid certificates mainly add organization validation and warranty, not better security.

How often does the certificate renew?

Let's Encrypt certificates are valid for 90 days and certbot renews them automatically around day 60 via a systemd timer; verify the setup once with certbot renew --dry-run.

What is mixed content and why does it break the padlock?

Mixed content is any image, script or style still loaded over http:// on an https:// page; browsers block or flag it, so run a database search-replace to update old absolute URLs.

Related articles

• How to point a domain to Cloud2Y VPS
• How to install WordPress with Nginx
• How to secure WordPress on a VPS
• WordPress security checklist

Ready to get started? Order a WordPress VPS at Cloud2Y →