“Install SSL” is the first 20% of an HTTPS migration. The remaining 80% — mixed content, redirects, HSTS, search console — determines whether the padlock shows, whether rankings survive, and whether the move creates new problems. The full sequence:
1. Install and force the certificate
Let’s Encrypt via the hosting panel (auto-renewal on), then enable the panel’s force-HTTPS so http requests upgrade at the server. Do this before touching content — the enforcement makes later steps observable.
2. Search-replace the URLs (serialized-safe)
wp search-replace "http://yoursite.com" "https://yoursite.com" --all-tables --allow-root — serialized options corrupt under raw SQL (the mechanism in the mixed-content guide). This fixes the database half; content references flip to https.
3. Hunt the stragglers
- Browser console per template — home, a post, a product, checkout, login: each page must show zero mixed-content lines.
- Hardcoded theme assets (header/footer templates with literal http links) — fix in templates, not the DB.
- External embeds — fonts, maps, iframes loaded over http.
- Builder and page caches — purge everything after the replace, or cached pages keep serving old URLs (the cache-layer trap).
4. Redirects that preserve everything
The force-HTTPS redirect should be 301 (permanent) so search engines transfer signals. Verify: curl -sI http://yoursite.com | head -1 shows 301 to the https URL. Watch for redirect chains (http→https→www→final) — each hop costs crawl budget and latency; flatten to one hop.
5. HSTS — deliberately, and last
HSTS tells browsers “https only, remember it” — powerful and sticky: enable it after you are certain every asset and subdomain serves https, because it is hard to undo for visitors who cached the policy. A conservative start (max-age weeks, not years) is the safe pattern.
6. Search Console and analytics
- Add the https property in Search Console and submit the https sitemap — http and https are separate properties with separate data.
- Verify analytics tracking fires on https pages (protocol-dependent tracking code occasionally breaks).
- Expect ranking flux for a couple of weeks — normal for protocol moves with clean 301s.
7. Verify the padlock is earned
Every key page — especially checkout and forms — shows a closed padlock with no “Not secure” caveats. Mixed content on exactly those pages does conversion damage (the pattern in the conversion checklist). The free audit scans key pages for mixed content and redirect chains.
Force HTTPS at the server, search-replace URLs serialized-safely, hunt mixed content per template, verify 301 redirects without chains, then update Search Console. The certificate is only the first step. Not with clean 301 redirects — expect a couple of weeks of flux while signals transfer. Add the https property in Search Console and submit the https sitemap. Last, after every asset and subdomain reliably serves https — HSTS is sticky and hard to reverse for visitors. Start with a conservative max-age. Redirect chains, cached pages, or HSTS not yet propagated. Check the redirect is a single 301 hop and purge page caches after the switch.What do I do after installing an SSL certificate?
Will switching to HTTPS hurt my rankings?
When should I enable HSTS?
Why do some visitors still see the old http site?
