How do I make my site always use HTTPS?

Once the free SSL certificate is working, open Domains → Domains in cPanel and switch on Force HTTPS Redirect for the domain. On WordPress, also make sure both addresses under Settings → General start with https://.

Check the certificate first. Open https://yourdomain.com and https://www.yourdomain.com. If either shows a warning instead of a padlock, fix that before forcing anything: see How do I get the padlock (free SSL) on my site?
Log in to cPanel and open Domains → Domains.
Find the domain and switch on Force HTTPS Redirect. If the switch is greyed out, the domain doesn’t have a working certificate yet.
Repeat for any other domain or subdomain on the account, such as shop.yourdomain.com.
Test in a private browser window: type http://yourdomain.com and check that it ends up on https://.

WordPress: two more checks

In wp-admin, open Settings → General and make sure WordPress Address (URL) and Site Address (URL) both start with https://. Save, then log in again.
If the padlock is missing on some pages, they still load an image, script or font over http:// (called mixed content). Edit the page and change the link, or run a search-and-replace plugin from http://yourdomain.com to https://yourdomain.com after taking a backup.

No switch in your cPanel?

Add these lines at the top of the .htaccess file in public_html, using File Manager. On WordPress, put them above the # BEGIN WordPress line.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Tip: If your site is behind Cloudflare and you get “too many redirects”, Cloudflare’s SSL mode is probably set to Flexible. Set it to Full (strict) once the free certificate is on the server. On Tremhost Armor, ask us and we’ll check it.

Will forcing HTTPS hurt my Google ranking?: No. The redirect is permanent (301), so search engines move to the https address. Google treats https as a small plus.
Should I turn on HSTS as well?: Only when every subdomain works on https. Browsers remember HSTS for months, so a subdomain without a certificate becomes unreachable for visitors who have seen it.

Still stuck? Open a support ticket with the domain, or message us on WhatsApp.

Updated 6 November 2026. Something here out of date? Tell us.