How to Redirect HTTP to HTTPS in WordPress without Plugin

If you recently bought an SSL certificate and want to redirect HTTP to HTTPS without using any plugin on your WordPress site, this simple .htaccess snippet will help you out. Using this code, you can force HTTPS to load by default across your entire website without losing traffic. Let's find out how to implement it.

Google has long stated that HTTPS helps websites rank well in search results, which is one reason SSL adoption has become the norm rather than the exception.

Once you have purchased an SSL certificate from your hosting provider or a third party, it's important to redirect HTTP to HTTPS correctly — a silly mistake here can cause a significant traffic loss.

Here I'll guide you through redirecting from HTTP to HTTPS without using cPanel or a WordPress plugin. I'm assuming the SSL certificate is already successfully installed on your domain.

What You'll Need

• FTP access to your website
• FileZilla software (or any FTP client)
• A text editor like Notepad or a code editor

Steps to Follow

1. Open your FTP application (e.g., FileZilla)
2. Connect to the home directory of your website
3. Locate the '.htaccess' file
4. Right-click and download it to your computer
5. Open this file using Notepad or a code editor

Now, simply copy the code below to the top of your .htaccess file:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.yoursite.com/$1 [R,L]
</IfModule>

Note: Make sure to change 'yoursite.com' to your actual domain name.

6. Save this file
7. Make sure to back up your existing .htaccess file before uploading the new one to your live website
8. Upload it — you're done!

Now, if you open your website without "www" or "http", it will automatically redirect to https://www.yoursite.com.

A Simpler Alternative on Most Hosting Today

Manually editing .htaccess is still a reliable method, but most hosting control panels today (cPanel, Plesk, or your host's custom dashboard) include a built-in "Force HTTPS Redirect" toggle under the SSL/TLS section, which does the exact same thing without touching any code. If your host offers this, it's the safer option — check there first before editing files manually.

Don't Forget These Follow-Up Steps

Redirecting HTTP to HTTPS is only half the job. To avoid ranking or display issues after the switch, also do the following:

• Update your WordPress Site Address and Home URL under Settings > General to use "https://" so WordPress itself doesn't generate mixed HTTP/HTTPS links.
• Fix mixed content warnings. Any images, scripts, or stylesheets still linked with "http://" will show a "not fully secure" warning in the browser. A search-and-replace across your database (or a one-time plugin run just for this) resolves it.
• Update your canonical URLs and sitemap to the HTTPS version, and resubmit your sitemap in Google Search Console.
• Update your Google Search Console and Analytics property to track the HTTPS version of your domain, so you don't lose historical data continuity.

Hope this guide helps! If it did, feel free to share it with your friends and on social media.