Moving Wordpress from http to https over existing site

Question

Situation: I have an existing non-Wordpress website with an active SSL-certificate.

I'd like to replace the existing website with a new Wordpress-site. After installing Wordpress I can access the Wordpress Hello World page and the admin through http://. The old website is still showing at https://

When changing http to https in Wordpress, for example by using the Really Simple SSL-plugin, I get locked out of accessing the admin, and nothing actually changes: the old site on https://, Wordpress on http:// The only way I've found to get back into admin, is reinstalling Wordpress altogether. . I've done a check on the security certificate: it's valid and working.

I'm totally stuck and out of my depth. Any suggestions what I should do? Thanks so much!

Answer 1

Some of the things I have to double-check when I install an SSL certificate on a WordPress website are:

Define SSL settings in wp-config.php to override WordPress database settings

/** Security for SSL */
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
    // If website is behind load balancer or reverse proxies that support HTTP_X_FORWARDED_PROTO
    $_SERVER['HTTPS'] = 'on';
}
$has_ssl = (isset($_SERVER['HTTPS']) && (strtolower($_SERVER['HTTPS'] === 'on') || $_SERVER['HTTPS'] == '1')) || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == '443'); // @see https://developer.wordpress.org/reference/functions/is_ssl/
define('FORCE_SSL_LOGIN', $has_ssl); // Secure user registration/login forms
define('FORCE_SSL_ADMIN', FORCE_SSL_LOGIN); // Secure WordPress admin dashboard

/** Site Domain */
define('DOMAIN_CURRENT_SITE', filter_input(
    INPUT_SERVER,
    'HTTP_HOST', // Relative URLs for swapping across app service deployment slots
    FILTER_SANITIZE_URL //Remove all characters except letters, digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=.
));
define('WP_HOME', 'http' . (FORCE_SSL_LOGIN ? 's' : '') . '://' . DOMAIN_CURRENT_SITE); // Override database value
define('WP_SITEURL', WP_HOME); // Override database value

In the .htaccess file

# AuRise: Use HTTP Strict Transport Security to force client to use secure connections only
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# BEGIN AuRise 301 (permanent) Redirect from HTTP to HTTPS
RewriteEngine On
RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# END AuRise 301 (permanent) Redirect from HTTP to HTTPS

I also want to note that if the installation is a multisite, you may need to remove the includeSubDomains; part to get it to work

I suspect the update to the .htaccess file is the one that might help in that it'll redirect you to always view the HTTPS version of the site. However, the issue about still getting locked out may or may not be addressed. Try these and then let me know what happens lol