https and the certificate

Module 3: Address, https and users · Reading time: 8 minutes

Learning objective: After this lesson you can put a WordPress website fully on https and you know what the WordPress address and the site address do.

Key concepts: TLS, certificate, Let's Encrypt, automatic renewal, WordPress address (siteurl), site address (home), WP_HOME and WP_SITEURL, HSTS, getting locked out

What https does

With https, everything between browser and server is encrypted: passwords, forms, cookies, even ordinary pages. Without https, anyone on the same network (public wifi, a hijacked router) can read along and even change the page. Browsers mark a website without https as "not secure" and some features (such as location or the camera) only work with https.

The encryption is called TLS. To prove that the browser is really talking to example.com and not to a middleman, the server has a certificate: digital proof, signed by an issuer that browsers trust. The certificate states the names it covers and until when.

Free certificates and renewal

Let's Encrypt issues free certificates. Almost every hosting provider requests them automatically and renews them automatically too. A certificate from Let's Encrypt is currently valid for 90 days, and Let's Encrypt has announced it will gradually shorten that validity to 45 days. Renewing by hand is therefore not an option: it must be automatic.

A paid certificate doesn't encrypt better. The difference lies in extra verification of the organisation (and sometimes a guarantee). For most websites, a free certificate is fine.

What to check:

• The certificate must cover every name a visitor might type: example.com and www.example.com. Also the name that only redirects, because the browser checks the certificate before the redirect happens.
• Automatic renewal only works if the DNS points to your server. If you've moved the DNS or put a proxy (such as Cloudflare) in front of it, check that renewal still works.
• A CAA record in the DNS can determine which issuers are allowed to create certificates. If Let's Encrypt isn't listed there, the request fails (DNS course lesson 5.2).

Two addresses in WordPress

Under Settings > General there are two addresses. They seem redundant, but they mean something different:

Usually they're the same, for example both https://example.com. They only differ if WordPress is installed in a subfolder but the website needs to appear at the root.

WordPress uses these addresses to build all links: to Pages, stylesheets, images, the admin area. If this is set to http://, WordPress builds pages with http:// links, even if the visitor arrives via https. That causes mixed content (lesson 3.2) and redirects back and forth.

Putting a website on https

If you have an existing website on http, these are the steps:

1. Request a certificate for both names and check that https://example.com works (you'll see a WordPress page, perhaps still without styling).
2. Make a backup (lesson 8.1).
3. Set both addresses under Settings > General to https:// and save. You'll be logged out; log in again via https.
4. Convert old links in the content from http://example.com to https://example.com. Do this with a tool that understands serialised data, such as wp search-replace or a search-and-replace plugin (lesson 3.2), never with a plain SQL command.
5. Redirect: have the web server send all requests on http to https with a 301 (lesson 3.2). Many hosting providers have a tickbox for this; otherwise a few lines in .htaccess.
6. Check with the exercise from this lesson and the one from lesson 3.2.

Locked out: when the address is wrong

If you type a typo in the addresses (htps://, a wrong domain), WordPress sends you to that wrong address after saving. You can no longer reach the admin area. Don't panic, there are two ways out:

Via wp-config.php. Add above the line "stop editing":

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

These lines take precedence over the values in the database. The fields in Settings > General then turn grey. Log in, set the correct values in the database, and remove the lines again (or deliberately leave them in place, so nobody can change the addresses by accident through the admin area).

Via phpMyAdmin. Open the table wp_options and adjust the values of siteurl and home.

HSTS: making the browser remember

With the header HSTS (Strict-Transport-Security), the server tells the browser: "only visit here via https for the time being." The browser then converts every http:// to https:// itself, without first making an unsecured request.

Strict-Transport-Security: max-age=31536000; includeSubDomains

HSTS is a good extra step, but with a warning: a browser that has seen HSTS will afterwards refuse to open the website without a valid certificate, not even with "proceed anyway". With includeSubDomains, that applies to every subdomain. If you have a subdomain without a certificate (for example an old internal system), it becomes unreachable after HSTS. So start with a short max-age (for example one day, 86400), check everything, and then extend it.

In practice: what it looks like in a panel

As an example we use DirectAdmin. In cPanel this section is called SSL/TLS Status (AutoSSL), in Plesk SSL/TLS Certificates.

1. Open SSL Certificates for your domain and choose Free and automatic certificate from Let's Encrypt.
2. Tick example.com and www.example.com and request the certificate.
3. In the domain settings, tick the option to always send visitors to https (in DirectAdmin: Force SSL with https redirection). Use only one method of redirecting: two different ones at the same time can cause a loop ("too many redirects").
4. In WordPress, go to Settings > General and set both addresses to https://.

Summary

• https encrypts everything between browser and server; the certificate proves who the server is.
• Free certificates from Let's Encrypt are short-lived and renewed automatically; they must cover every name a visitor types.
• WordPress Address (siteurl) and Site Address (home) must both be set to https://.
• If you get locked out because of a wrong address, fix it with WP_HOME and WP_SITEURL in wp-config.php or in phpMyAdmin.
• HSTS is a good extra step; start with a short validity period.

Quiz

Exercise

Exercise A3.1: Is your certificate correct? Enter your website's address. The program makes a TLS connection with the bare name and with www (if it exists) and checks: is the certificate valid and trusted, does it cover both names, is it valid for longer than 14 days, and does the website send an HSTS header? If HSTS is missing, that's shown as orange with an explanation, not as an error.

Further reading

These articles describe the steps in WebOké's panels; in other panels they work in a similar way.

• DirectAdmin guide 6.1: What is SSL and how does WebOké arrange it?
• DirectAdmin guide 6.2: Requesting a free Let's Encrypt certificate
• DirectAdmin guide 6.3: Certificate for www, subdomains and wildcard
• DirectAdmin guide 6.4: Always redirect visitors to https
• Activating, renewing, and troubleshooting SSL certificates
• The difference between a free and a paid certificate
• Free DNS course 5.2: CAA: who's allowed to issue certificates?