I've been tasked with converting about 100 sites in my multisite instance to HTTPS.

I can easily write a script to hit the DB and change the siteurl and home values to HTTPS, which inturn should force the site to enqueue scripts and future embeded images to HTTPS right?

Well I'll also need to go through all post_content for any internal links, as well as images using HTTP and convert those to HTTPS.

I could probably whip something together to do that, but Im wondering what else I need to change. GUIDs right? If I used the $wpdb commands would I need to reserialize the DB afterwards?

I should have ask first, is there a reliable plugin that will take care of this for me? What else do I need to know about this process?

Notes - We already have all the SSL certs so thats something I dont have to worry about. - Server is running linux(redhat) and apache - The multisite is using sub directories - I dont know much else tho, the server is outside my jurisdiction

  • Does your multisite use subdirectories or subdomains? What web server (Apache, nginx, etc) are you using? That'll have some bearing on the kind of SSL certificate you're shopping for.
    – Pat J
    Nov 12 '15 at 22:09
  • Thanks Pat, I edited my question with the information you asked about.
    – rugbert
    Nov 12 '15 at 22:20
  • Be careful with automated find and replace - if you have serialized data in the database, you'll break it by changing http to https if you don't change the string length too!
    – Steven
    Aug 17 '16 at 9:00
  • Hi @rugbert,were you able to solve this question? Just checking if my answer was helpful to your question. Aug 22 '16 at 14:19
  • Updating siteurl and home in the wp_options database table was the missing piece of information to my simpler puzzle. Thanks for mentioning that!
    – sampi
    Jun 26 '20 at 15:08

You could run a script to UPDATE all urls and guids to https, if you want a clean setup.

But also consider alternatives such as:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.yoursite.com/$1 [R,L]

In wp-config.php for the backend:

define('FORCE_SSL_ADMIN', true);

In wp-config.php for the frontend (or run a db UPDATE script):


Then you could simply run a script to UPDATE all wp_posts content url.


This process actually involves purchasing a security Certificate and applying it to your server for your websites. This will in turn force everyone visiting into a secure connection via the certificate presented by your server. These certificates are called SSL Certs: http://www.DigiCert.com/SSL-Certificates

  • Thanks John, I forgot to mention that we have all the SSL certs.
    – rugbert
    Nov 12 '15 at 22:17
  • Ok in that case have the certs been applied and all of your sites relisted correctly in DNS files? I have to ask do you host onsite or with a third party? What OS is server Environment?
    – John Lucey
    Nov 12 '15 at 22:19
  • We are using a third party to host. I dont have too much info or access to the server, but its a redhat linux server running apache. I am more concerened about what I need to to to the DB
    – rugbert
    Nov 12 '15 at 22:22
  • 1
    I do not believe anything has to be done to the database. SSL is server side not DB. My advice would be to ensure that the Certs have been applied to the server and verify by using https in your url to test validity. If the site shows up you should be able to just type the old URL with no https and it will automagically bring you in https. Been a while since I have deployed a cert so sadly I canot help you through those steps but your engineers should be able to handle that for you as well as the DNS redirect file on the server for correcting the url server side.
    – John Lucey
    Nov 14 '15 at 0:06

One possible way to do this data modification is to use WP-CLI on the terminal.

First of all, you should make sure you have a backup and a solid restore strategy in case anything goes wrong. You should also test this procedure on a local or testing system with a copy of the live database.

The basic steps are, to iterate over each site of your network and replace the URLs of each site using WP-CLI's search-replace command.

Here's a bash one-liner:

for SITE in $(wp site list --field=url); do wp search-replace "{$SITE}" "${SITE/http:/https:}" --dry-run --precise --network --verbose; done

Let's examine that:

for SITE in $(wp site list --field=url);

That one starts a loop for each line of the output of the command inside $() and writes each line in the variable $SITE.

$(wp site list --field=url)

That's the WP-CLI site list command which gives you a list of all site URLs in your network. Run this command solely, you will probably see something like:



...); do

will just start the inner loop part.

The inner loop command does all the magic (I split it to two lines using \ for readability):

wp search-replace "$SITE" "${SITE/http:/https:}" \
--dry-run --precise --network --verbose

We tell WP-CLI to search for $SITE (e.g. https://your-site.tld/) and replace it with a slightly modified version: ${SITE/http:/https:}. This is a bash string replaces operation that replaces http: with https:. (So resolving the variables, the command would look like wp search-replace "http://your-site.tdl/" "https://your-site.tld/").

search-replace has many possible options that are described in the documentation. In the example I used these:

--dry-run --precise --network --verbose

--dry-run and --verbose are clearly helpful for testing the command.

--network applies the search and replace operation also to the network tabels.

--precise tells WP-CLI to use PHP instead of SQL to search and replace the values. That ensures serialized values to not get corrupted.

Finally the loop is closed with

; done

Let me emphasize it again: test this deeply before you start using this on production. You should understand how it work and what WP-CLI does. I used WP-CLI before to perform such searach and replace operations to migrate multisites to other domain names, but not to switch from http to https.

There might be some edge cases: WP-CLI still reads the wp-config.php and try to find a matching «network» in the database by using the constants in wp-config.php. If you're manipulating one site (the database) but not the other one (the constants in wp-config.php) you might get into trouble. But for your case, I think that won't be a problem as WP typically relies on DOMAIN_CURRENT_SITE and PATH_CURRENT_SITE and they won't change anyway. But again, test this thorough.

With a bit more bash magic, you could also split this loop into chunks of 5 or 10 sites and go through it step by step.

  • why not interconnectit.com/products/… ?
    – KnightHawk
    Aug 8 '16 at 18:46
  • You ask the question in the wrong direction. The correct one would be: why should one use this plugin? What are the benefits in comparison to the described CLI approach?
    – David
    Aug 9 '16 at 6:15

To ensure all of your websites use HTTPS in your post_content, you can perform one of two options:

1. Backend: execute a SQL query

To make sure that all of your HTTP links are set as HTTPS, use the following SQL query:

UPDATE wp_options SET option_value = replace(option_value, 'OLD_URL', 'NEW_URL') WHERE option_name = 'home' OR option_name = 'siteurl';
UPDATE wp_posts SET guid = replace(guid, 'OLD_URL','NEW_URL');
UPDATE wp_posts SET post_content = replace(post_content, 'OLD_URL', 'NEW_URL');
UPDATE wp_postmeta SET meta_value = replace(meta_value,'OLD_URL','NEW_URL');
  • OLD_URL will be replaced with http://example.com (non-HTTP)
  • NEW_URL will be replaced with https://example.com (HTTPS)

This will cover the siteurl, home, and all of your content on your website to the new HTTPS.

2. Frontend: use the Search & Replace plugin

A more user-friendly approach is to use the Search & Replace plugin to easily replace all tables that contain your old HTTP and change them to a HTTPS. The process is easy to use and you can preview what tables and rows will be affected before applying those changes.


Before applying any changes, I think it goes without saying to always make a backup of your database in the event something goes wrong.


HTTP is a default protocol, which is used by most websites to handle the information over the web. Your website is running on HTTPS without any error message, it means your certificate has been installed correctly. You should migrate your entire website from HTTP to HTTPS.

Learn how to move HTTP to HTTPS for WordPress

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.