How to Fix SSL Certificate Error on WordPress (2026)

Learning how to fix ssl certificate error on wordpress is urgent the moment it happens — browsers show visitors a frightening red warning page, traffic drops off a cliff, and Google starts treating your site as untrustworthy. The good news is that nearly every SSL error on WordPress comes from a small set of causes, and each has a straightforward fix.

This guide walks you through diagnosing the exact error first (because the fix depends on the cause), then the step-by-step solutions: installing or renewing the certificate, fixing mixed content, correcting the WordPress URL settings, and handling plugin conflicts. Work through them in order and your padlock will be back.

Step 1: Identify Exactly Which SSL Error You Have

Different errors mean different problems. Open your site in an incognito window and read the browser’s message carefully:

• “Your connection is not private” / NET::ERR_CERT_DATE_INVALID. The certificate is expired, not yet valid, or the visitor’s clock is wrong. The most common cause on WordPress sites.
• NET::ERR_CERT_AUTHORITY_INVALID. The certificate was self-signed or issued by an authority the browser does not trust. Common right after migrating hosts or installing a certificate incorrectly.
• NET::ERR_CERT_COMMON_NAME_INVALID. The certificate does not cover the domain being visited — for example, it covers yourdomain.com but not www.yourdomain.com.
• Mixed content warnings (padlock with a warning triangle). The page loads over HTTPS but some images, scripts, or stylesheets still load over HTTP. The certificate is fine; the page’s content is not.
• “Too many redirects” after enabling SSL. WordPress and the server disagree about whether the connection is secure — usually a URL setting or plugin misconfiguration.

Step 2: Install or Renew the Certificate to Fix the SSL Error

Most SSL errors trace back to a missing or expired certificate. Fix it at the source:

• Check the certificate status. In cPanel, open SSL/TLS Status. Look for your domain — it shows whether a certificate is installed, who issued it, and when it expires.
• Run AutoSSL. Select your domain and click “Run AutoSSL.” cPanel will request and install a free certificate automatically. This resolves the majority of WordPress SSL errors in one click.
• Or install Let’s Encrypt. If your host offers a Let’s Encrypt option in cPanel, use it to issue a certificate for both yourdomain.com and www.yourdomain.com — covering both versions prevents the common-name error above.
• Wait for provisioning. New certificates can take minutes to a few hours to become active. Clear your browser cache (or test in incognito) before concluding it failed.
• Enable auto-renewal. Free certificates expire every 90 days. Confirm your host renews them automatically — an expired certificate is the single most common SSL error, and it is entirely preventable.

Step 3: Fix Mixed Content Blocking Your WordPress SSL Fix

Your certificate can be perfect and browsers still warn visitors if the page itself loads resources over plain HTTP. This usually happens after switching an existing site from HTTP to HTTPS.

• Find the culprits. Open the broken page, press F12 to open developer tools, and look at the Console tab. Every “Mixed Content” warning names the exact image, script, or stylesheet loading over HTTP.
• Fix it with a plugin (easiest). Install Really Simple SSL — it rewrites HTTP URLs to HTTPS across your content automatically and handles most mixed-content issues without manual work.
• Or fix it with search-and-replace. Use the Better Search Replace plugin to replace http://yourdomain.com with https://yourdomain.com across the database. Back up first — search-and-replace is powerful and unforgiving.
• Check hardcoded theme and widget URLs. Logo URLs, custom CSS, and text widgets sometimes contain hardcoded http:// links. Update them to https:// (or protocol-relative) manually.

“Nine times out of ten, a WordPress SSL error is one of three things: an expired certificate, a URL setting still on http, or a single image loading insecurely.”

Step 4: Correct the WordPress URL Settings

WordPress stores its own address in the database, and if it still says http:// after you installed SSL, the site will fight itself — generating redirect loops and insecure links.

• Check both URL fields. Go to Settings, then General, and look at “WordPress Address (URL)” and “Site Address (URL).” Both must start with https:// — not http://.
• Fix them if the dashboard is unreachable. If a redirect loop locks you out, edit wp-config.php via cPanel File Manager and add two lines above the “stop editing” comment: define(‘WP_HOME’,’https://yourdomain.com’); and define(‘WP_SITEURL’,’https://yourdomain.com’); — using your actual domain.
• Clear caches after the change. Caching plugins and CDNs (like Cloudflare) may serve old http:// versions. Purge all caches, including any server-level cache your host provides.

Step 5: Resolve Plugin and CDN Conflicts

When the certificate is valid and URLs are correct but problems persist, a plugin or CDN setting is usually interfering:

• Deactivate SSL-related plugins one by one. Really Simple SSL, Cloudflare plugins, and security plugins can conflict with each other. Deactivate them, test, and reactivate one at a time to find the culprit.
• Check Cloudflare’s SSL mode. If you use Cloudflare, its SSL/TLS setting must be “Full” or “Full (Strict)” — not “Flexible.” Flexible mode is the classic cause of WordPress redirect loops because Cloudflare talks HTTPS to visitors but HTTP to your server.
• Look for force-HTTPS rules. Check .htaccess and security plugin settings for duplicate HTTPS redirect rules. Two plugins both forcing HTTPS can create the very redirect loop they were meant to prevent.
• Test with a default theme. Briefly switch to a default WordPress theme. If the error disappears, your theme hardcodes insecure URLs somewhere — check its settings or contact the theme developer.

FAQ

Why does my WordPress site say “not secure” even with SSL installed?

Almost always mixed content — the certificate is fine, but something on the page (an image, script, or stylesheet) still loads over HTTP. Check the browser console (F12) for Mixed Content warnings to find the exact resource.

How do I know if my SSL certificate expired?

Click the padlock (or warning) icon in the browser address bar and view the certificate details — it shows the expiry date. In cPanel’s SSL/TLS Status you can see expiry dates for all your domains at a glance.

Is a free SSL certificate good enough for WordPress?

Yes. Free certificates from Let’s Encrypt or cPanel AutoSSL provide the same encryption as paid ones. Paid certificates only add extras like warranty or extended validation display — encryption itself is identical.

Will fixing SSL affect my Google rankings?

Positively. Google uses HTTPS as a ranking signal, and removing browser warnings stops visitors from bouncing. Migrate carefully (update URLs, fix mixed content, keep redirects clean) and rankings typically improve, not drop.

What causes the “too many redirects” error after enabling SSL?

WordPress and the server disagreeing about HTTPS — usually the WordPress Address settings still say http://, Cloudflare is in Flexible mode, or two plugins are both forcing HTTPS redirects. Fix the URL settings first; that resolves most cases.

Conclusion

Knowing how to fix ssl certificate error on wordpress is mostly about diagnosing before treating: read the browser’s exact error, check the certificate status in cPanel and renew with AutoSSL if needed, hunt down mixed content, correct the WordPress URL settings to https://, and untangle any plugin or Cloudflare conflicts.

Work through those steps in order and the red warning becomes a green padlock again. Then set a calendar reminder to check certificate expiry — or confirm auto-renewal is on — so you never meet this error twice.