Once your site has an SSL certificate, every visitor should be sent to the secure https:// version automatically. This guide shows you how to force HTTPS on a website hosted with Instant Access Internet Services using the Force HTTPS Redirect switch in cPanel, with an .htaccess option and WordPress tips if you need them.
Before you start: check your SSL certificate
Your domain gets a free SSL certificate automatically through AutoSSL, as long as it points to our nameservers. Make sure it's active before forcing HTTPS, or visitors will see a security warning.
- In cPanel, go to Security > SSL/TLS Status.
- Check that your domain and
www.version show a valid certificate. - If they don't, see Free SSL Certificates: How AutoSSL and SSL/TLS Status Work. A new domain can take a few hours to get its certificate after DNS starts pointing to us.
How to force HTTPS in cPanel (easiest)
- In cPanel, go to Domains > Domains.
- Find your domain in the list.
- In the Force HTTPS Redirect column, click the switch so it turns On.
That's it. Anyone who visits http://example.com is now sent to https://example.com. To undo it, click the switch again to turn it off.
If the switch is greyed out or missing, the domain doesn't have a valid SSL certificate yet. Fix that first (see above).
WordPress: update your site address
If your site runs WordPress, also tell WordPress to use HTTPS, otherwise pages can load with broken styling or a "Not Secure" warning.
- Log in to WordPress admin and go to Settings > General.
- Change both WordPress Address (URL) and Site Address (URL) so they start with
https://. - Click Save Changes and log in again.
If images or scripts inside your pages still load over http://, the browser will show a mixed content warning. See How to Fix "Not Secure" Warnings and Mixed Content Errors for how to fix that.
Alternative: force HTTPS with .htaccess
If you'd rather control the redirect yourself, or you also want to choose www or non-www in the same step, use an .htaccess rule instead of the switch. Don't use both at once.
- In cPanel, go to Files > File Manager and open
public_html. - If you can't see
.htaccess, click Settings, tick Show Hidden Files (dotfiles) and click Save. - Right-click
.htaccessand choose Edit. - Add these lines at the very top of the file, above any
# BEGIN WordPresssection:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]
- Click Save Changes.
To also pick www or non-www in the same redirect, use the rules in WWW or Non-WWW: How to Redirect Your Domain instead.
Test it
Open a private/incognito window and type http://example.com (with your own domain). The address bar should change to https:// and show a padlock.
Troubleshooting
"Too many redirects" after turning on HTTPS
- If you used both the Force HTTPS Redirect switch and an
.htaccessrule, remove one of them. - Check Domains > Redirects for an old redirect pointing back to
http://, and delete it. - If a WordPress plugin also forces HTTPS, check its settings.
- If you use Cloudflare, set its SSL/TLS mode to Full or Full (strict), not Flexible.
The padlock is missing even though the address starts with https
That's almost always mixed content: something on the page is still loading over http://. See How to Fix "Not Secure" Warnings and Mixed Content Errors.
Does forcing HTTPS affect my email or cPanel login?
No. It only affects visitors to your website.
Related guides
- Free SSL Certificates: How AutoSSL and SSL/TLS Status Work
- How to Fix "Not Secure" Warnings and Mixed Content Errors
- WWW or Non-WWW: How to Redirect Your Domain
- How to Set Up a 301 Redirect in cPanel
Still stuck? Open a support ticket and the Instant Access Internet Services team will help.
