pixl

How to implement SSL without using a plugin

Michael Kwan · 17 July 2019 · Updated 15 August 2026

Tutorials

If you're using WordPress, chances are you'll come across tutorials or web designers telling you to use the Really Simple SSL plugin to add SSL encryption to your site. It's easy to install, easy to undo, and causes the fewest problems, so it's a solid choice for non-technical people. But in WordPress we generally try to reduce our dependency on plugins where possible, so here's how to do it the "proper" way without slowing your website down.

One thing first: this method edits .htaccess, which only works on Apache servers. If your host runs Nginx, .htaccess is ignored completely and none of this will do anything. Also worth knowing: most managed hosts now issue a free Let's Encrypt certificate automatically – check your hosting dashboard first, you may already be covered.

1. Make sure you actually have an SSL certificate

Don't assume you have SSL enabled. Go to https://yourwebsite.com to see if the certificate loads fine or not. If you don't have SSL, talk to your web hosting provider.

2. Edit your .htaccess file

You can do it two ways:

  1. By going directly into your hosting file manager, it's usually in your root folder.
  2. By using a custom .htaccess code manager that's part of another plugin (don't install another plugin just to edit .htaccess... that'll defeat the entire purpose of this exercise lol). For instance, Swift Performance has a custom .htaccess section where you can paste your code in. Convenient if you already use Swift by default.

Use this code:

Option 1 (preferred):

RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Header set Strict-Transport-Security "max-age=31536000" env=HTTPS

Option 2 (if option 1 doesn't work):

# Redirect non-SSL to SSL
RewriteCond %{HTTPS} !on
RewriteCond %{SERVER_PORT} !^443$
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# Redirect www to non-www (SSL)
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www.yourwebsite\.com [NC]
RewriteRule ^(.*)$ https://yourwebsite.com/$1 [L,R=301]

Credit: Swift Performance

3. Replace hardcoded non-SSL links with Better Search Replace

Your webpage may be SSL encrypted but depending on how your website was built, it may still be pulling content from the non-SSL link. This results in Chrome not showing the secure padlock – see whynopadlock.com for more on this.

To fix this:

Before you start: Better Search Replace does not have an "undo" feature, so be very careful and watch for typos!

  1. Download and activate Better Search Replace
  2. Use these settings:
    • Search for http://yourwebsite.com
    • Replace with https://yourwebsite.com
    • Select all tables
    • Case insensitive (check), Replace GUIDs (check), Run as dry run (uncheck)
  3. Run Search/Replace
  4. Repeat steps 2 and 3 with:
    • Search for http%3A%2F%2Fyourwebsite.com
    • Replace with https%3A%2F%2Fyourwebsite.com

4. Test

Open a new tab and type yourwebsite.com (without the https:// prefix) and it should load the SSL version automatically, with the secure padlock if you're on Chrome.

All posts