SSL Manager
WordPress SSL Certificate Expired: How to Fix It
An expired WordPress certificate may have been renewed without being deployed. Identify the certificate visitors receive, replace it safely, and repair renewal.
Main Menu
A certificate is easy to install and surprisingly easy to install in a way that leaves the padlock broken. The certificate itself is rarely the problem — what usually goes wrong is everything around it: assets still requested over http, redirects that loop, a proxy that does not tell WordPress the connection was secure.
These guides start with the certificate — installing one, reading what it actually says, checking expiry before a browser does it for you, and understanding the errors that appear when the name on it does not match the address people typed.
The largest group covers mixed content, which is the reason most sites show “Not secure” after a migration to https. A single stylesheet, script or image loaded over http is enough to break the padlock on an otherwise correct page, and the browser console will name it precisely if you know where to look. Forms and AJAX requests fail the same way, more visibly.
Then redirects, because forcing https is where sites most often break themselves: one rule too many and every request bounces until the browser gives up. Getting from http to https should take exactly one hop, and the same is true of choosing between www and non-www.
Finally the headers that make https stick — HSTS and its preload list, which is genuinely difficult to undo. Read the risks before you submit.
An expired WordPress certificate may have been renewed without being deployed. Identify the certificate visitors receive, replace it safely, and repair renewal.
Install SSL for WordPress in the correct order: issue a certificate for every hostname, bind the full chain at the public endpoint, verify HTTPS, then update WordPress URLs and redirects.
Redirects, canonical tags, hreflang, internal links, and XML sitemaps should identify the same HTTPS resource. Align every signal and verify the destination first.
An HTTPS form can fail when its action, admin-ajax call, REST request, or provider endpoint still uses HTTP. Find the URL producer and preserve validation and nonce checks.
A padlock on the home page is not a complete HTTPS check. Test every hostname and address family, certificate renewal, redirects, application paths, and mixed content.
Use .htaccess for HTTPS redirects only on the active Apache path, after TLS works. Account for proxies, keep one redirect owner, and preserve paths and queries.
Mixed-content images can come from post HTML, srcset, CSS, attachment data, or a CDN. Find the URL producer, provide HTTPS, update owned references safely, and clear caches.
Force WordPress to use HTTPS safely by validating TLS first, choosing one redirect owner, and testing proxy headers, administration, and callbacks.
Find out why WordPress still shows a security warning after SSL by checking the hostname, certificate chain, redirects, proxy settings, and page resources separately.
Find and fix HTTP resources on an HTTPS WordPress page without damaging serialized content, themes, or third-party integrations.