Having an SSL certificate does not, by itself, stop anyone loading the unencrypted version of your site. A redirect makes sure every visitor ends up on HTTPS regardless of how they arrived.
Why it matters
Without a redirect you effectively have two copies of every page, one secure and one not. Browsers flag the insecure version as "not secure", search engines may index both and split the ranking signal between them, and any form on the plain HTTP version transmits in clear text.
The .htaccess rule
Create or edit .htaccess in public_html and add this at the very top, before any other rules:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]R=301 makes it a permanent redirect, which is what you want — it tells search engines the HTTPS version is canonical and transfers the ranking signal. A 302 would not.
Also forcing www, or removing it
Pick one and be consistent. To force the non-www version as well:
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://yourdomain.co.uk%{REQUEST_URI} [R=301,L]Replace yourdomain.co.uk with your actual domain.
If you use Cloudflare
Set SSL mode to Full (strict). With "Flexible", Cloudflare connects to your server over plain HTTP while telling the browser the connection is secure — your redirect then fires on every request and produces an infinite loop. This is the single most common cause of redirect loops on proxied sites.
WordPress
Update Settings → General so both the WordPress Address and Site Address begin with https://. Without this you get mixed-content warnings where the page loads securely but images or scripts do not.
Checking it worked
Type your domain with http:// explicitly and confirm the browser lands on https://. Test the www version too. Then open a page in a private window and check the padlock has no warning triangle — a triangle means mixed content, usually a hardcoded http:// image URL somewhere in your theme or content.
Stuck in a redirect loop? Comment out the rule, confirm the site loads, then reintroduce it one line at a time. Or post the rule in the forum.
Going further: HSTS
A redirect still allows one insecure request — the first one, before the browser is told to switch. HSTS (HTTP Strict Transport Security) closes that window: it is a response header telling browsers to refuse plain HTTP for your domain for a set period. Once the redirect above is confirmed working on every page, add beneath it:
Header always set Strict-Transport-Security "max-age=31536000"
One warning before you do: HSTS is a promise browsers remember. If any part of your site still needs plain HTTP — or you later move somewhere without SSL — visitors’ browsers will refuse to connect until the max-age expires. Start with a shorter max-age such as 86400 (one day) if you want a cautious trial period, and only lengthen it once you are confident.
Rule order matters
.htaccess rules run top to bottom, and the HTTPS redirect should be the first rewrite rule in the file — before WordPress’s own block, before any custom redirects. Put it after other rules and visitors can be bounced around by an earlier rule while still on HTTP, producing either an extra redirect hop (slower, and it leaks the request in plain text) or a loop. If you edit the file and WordPress later rewrites its own section, check your rule is still above the # BEGIN WordPress block.
Testing like a professional
The browser hides redirect detail; these show it plainly:
- A free online redirect checker shows the full chain for any URL. You want exactly one hop:
http://→301→https://. Two or three hops means rules are fighting and worth consolidating. - Test four variants: http, https, with www, without. All four should end at your single canonical address.
- Test a deep page, not just the homepage — a correct rule preserves the path, so
http://…/about/must land onhttps://…/about/, not on the homepage.
Frequently asked questions
Will the redirect hurt my search rankings?
The opposite. A 301 to HTTPS consolidates the two versions of every URL into one, which is what search engines want, and HTTPS itself is a ranking signal. Expect rankings to settle within days as the index updates; any wobble is temporary.
Do I need to tell Google about the change?
Search engines follow 301s on their own. If you use Search Console, make sure the HTTPS version of the property is added and submit your sitemap under it — that is the whole job.
Does redirecting slow the site down?
The redirect itself is a single, near-instant response, and it only happens when someone arrives on the wrong scheme. Returning visitors and every internal link go straight to HTTPS. With HSTS in place, even the first hop disappears for repeat visitors.
Why 301 and not 302?
301 means permanent, which tells browsers to cache the redirect and tells search engines to transfer ranking signals to the HTTPS URL. A 302 (temporary) does neither reliably. Since you are never going back to HTTP, permanent is the truthful answer.