Situation: I have an existing non-Wordpress website with an active SSL-certificate.

I'd like to replace the existing website with a new Wordpress-site. After installing Wordpress I can access the Wordpress Hello World page and the admin through http://. The old website is still showing at https://

When changing http to https in Wordpress, for example by using the Really Simple SSL-plugin, I get locked out of accessing the admin, and nothing actually changes: the old site on https://, Wordpress on http:// The only way I've found to get back into admin, is reinstalling Wordpress altogether. . I've done a check on the security certificate: it's valid and working.

I'm totally stuck and out of my depth. Any suggestions what I should do? Thanks so much!

  • I'm wondering if it's a cache thing. Have you tried accessing the https version of WordPress from a different browser? Chrome, even when incognito, does this to me sometimes
    – AuRise
    Commented Oct 6, 2022 at 16:43

1 Answer 1


Some of the things I have to double-check when I install an SSL certificate on a WordPress website are:

Define SSL settings in wp-config.php to override WordPress database settings

/** Security for SSL */
    // If website is behind load balancer or reverse proxies that support HTTP_X_FORWARDED_PROTO
    $_SERVER['HTTPS'] = 'on';
$has_ssl = (isset($_SERVER['HTTPS']) && (strtolower($_SERVER['HTTPS'] === 'on') || $_SERVER['HTTPS'] == '1')) || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == '443'); // @see https://developer.wordpress.org/reference/functions/is_ssl/
define('FORCE_SSL_LOGIN', $has_ssl); // Secure user registration/login forms
define('FORCE_SSL_ADMIN', FORCE_SSL_LOGIN); // Secure WordPress admin dashboard

/** Site Domain */
define('DOMAIN_CURRENT_SITE', filter_input(
    'HTTP_HOST', // Relative URLs for swapping across app service deployment slots
    FILTER_SANITIZE_URL //Remove all characters except letters, digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=.
define('WP_HOME', 'http' . (FORCE_SSL_LOGIN ? 's' : '') . '://' . DOMAIN_CURRENT_SITE); // Override database value
define('WP_SITEURL', WP_HOME); // Override database value

In the .htaccess file

# AuRise: Use HTTP Strict Transport Security to force client to use secure connections only
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# BEGIN AuRise 301 (permanent) Redirect from HTTP to HTTPS
RewriteEngine On
RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# END AuRise 301 (permanent) Redirect from HTTP to HTTPS

I also want to note that if the installation is a multisite, you may need to remove the includeSubDomains; part to get it to work

I suspect the update to the .htaccess file is the one that might help in that it'll redirect you to always view the HTTPS version of the site. However, the issue about still getting locked out may or may not be addressed. Try these and then let me know what happens lol

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.