There are several guides online (Wpmudev, CSS Tricks & WP Beginner) that take you through the steps which are involved in making your WordPress site work with an SSL certificate.

Each guide talks about adding the following to wp-config.php to enable SSL within WP Admin:

define('FORCE_SSL_ADMIN', true);

The guides also recommend forcing an SSL rewrite via .htaccess. Something along the lines of:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

I've run a search and replace on the database, replacing all instances of http:// to https://. As this is the case, do I really need to add the additional snippets to wp-config.php and .htaccess?

The site works perfectly with SSL with the search and replace method that I have used. I've just added the following to my wp-config.php file to prevent any re-direct loops.

$_SERVER['HTTPS'] = 'on';

It's also important to note that this site has had SSL from the beginning, so I guess the 301 re-direct via .htaccess isn't required.

I just want to ensure that the recommended snippets do not serve any other purpose that I may have missed.

1 Answer 1


It is not absolutely necessary to add anything to the config file. However it's a good idea to do a test to look for any unsecured Http calls, such as stylesheets or Scripts. A good resource for this is https://www.whynopadlock.com/.

The force SSL Setting can sometimes help with requests coming from plug-ins or anything you may have had coded that is prefixed by an unsecured http://.

However the bottom line is as long as you are requesting any internal http (as opposed to https) addresses, you should be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.