If your website opens with http:// instead of https://, visitors may see a Not Secure warning in their browser. This can reduce visitor confidence, especially if your website contains login forms, contact forms, or payment pages.
HTTPS protects the connection between a visitor's browser and your website through encryption. To use it, your domain needs a valid SSL certificate, and your website should redirect HTTP visitors to its secure HTTPS version.
Hostinger makes this process easier through its hPanel SSL settings. Once SSL is installed on supported hosting plans, HTTPS is enabled by default. You can also check the Force HTTPS setting to make sure visitors are redirected to the secure version.
Table of Contents
- What is HTTPS?
- Why should you force HTTPS?
- Things to check before enabling HTTPS
- Install or check your SSL certificate
- Force HTTPS using Hostinger hPanel
- Force HTTPS on WordPress
- Redirect HTTP to HTTPS using .htaccess
- Verify that HTTPS is working
- Fix mixed-content errors
- Common HTTPS problems and solutions
- How to disable Force HTTPS
- Frequently asked questions
1. What Is HTTPS?
HTTPS stands for Hypertext Transfer Protocol Secure. It is the secure version of HTTP, the protocol used by browsers and web servers to communicate.
HTTPS uses encryption through TLS (Transport Layer Security) to protect information transferred between a visitor's browser and your website.
For example, compare these two website addresses:
| Website URL | Connection |
|---|---|
http://example.com | Unencrypted HTTP connection |
https://example.com | Encrypted HTTPS connection |
When a website uses HTTPS correctly, the browser can establish an encrypted connection after validating the website's SSL/TLS certificate.
What is an SSL certificate?
An SSL certificate is a digital certificate used to authenticate a website's identity and enable an encrypted connection. Although the term SSL is commonly used, modern secure connections use TLS.
When a visitor opens an HTTPS website, the browser checks the certificate and establishes a secure connection if the certificate is valid and correctly configured.
Hostinger offers SSL certificates for supported hosting services, including Lifetime SSL on eligible Web and Cloud hosting plans.
What does Force HTTPS mean?
Force HTTPS is a setting that redirects visitors from the HTTP version of your website to the HTTPS version.
For example, if someone enters:
http://example.comthe website automatically sends them to:
https://example.comThis helps ensure that visitors consistently access the secure version of your website instead of the unencrypted HTTP version.
2. Why Should You Force HTTPS on Your Website?
Enabling HTTPS is an important part of website security and maintenance. It helps protect visitors and ensures that your website uses one consistent secure version.
1. Protect visitor information
HTTPS encrypts information exchanged between the visitor's browser and your website. This is particularly important when visitors submit contact forms, sign in to accounts, or enter other personal information.
2. Improve visitor trust
Modern browsers can display security warnings for websites that do not use HTTPS. A valid HTTPS connection helps visitors feel more confident when browsing your website.
3. Support website SEO
Google has used HTTPS as a lightweight ranking signal. Using HTTPS is also a useful technical SEO practice because it helps establish a consistent preferred version of your website.
However, HTTPS alone does not guarantee better rankings. Website content, relevance, performance, and many other factors influence search results.
4. Avoid duplicate HTTP and HTTPS versions
Without a proper redirect, visitors and search engines may be able to access both HTTP and HTTPS versions of the same page.
Forcing HTTPS helps consolidate visitors onto the secure version of your website and supports consistent canonical URLs.
5. Protect login and payment pages
If your website has a login page, customer account, checkout, or payment form, HTTPS is essential for protecting information during transmission.
3. Things to Check Before Enabling HTTPS on Hostinger
Before forcing HTTPS, make sure your domain and SSL certificate are configured correctly. Otherwise, visitors may encounter certificate warnings or connection errors.
1. Confirm that your domain points to Hostinger
Your domain should point to the correct hosting destination. If you recently changed nameservers or DNS records, the changes may still be propagating.
Check your domain's DNS configuration and confirm that the required records match the values provided by Hostinger.
2. Check your SSL certificate status
Open your website's SSL management section in hPanel. Check whether the certificate is active, still installing, or showing an error.
Do not force HTTPS until the certificate is correctly installed and available for the hostname visitors use.
3. Check both www and non-www versions
Your website may be accessed using either of these addresses:
https://example.com
https://www.example.comCheck that the SSL certificate covers the domain versions you intend to use and that your preferred domain redirects correctly.
4. Back up your WordPress website
If you are changing WordPress URLs or editing configuration files, create a backup first. This gives you a recovery option if a redirect rule or URL change causes problems.
5. Check existing redirect rules
If you already use a WordPress redirect plugin, CDN, Cloudflare, or custom server rules, check for existing HTTP-to-HTTPS redirects.
Multiple conflicting rules can create redirect loops. Ideally, use one primary method to enforce HTTPS and remove unnecessary duplicate rules.
4. How to Install or Check an SSL Certificate on Hostinger
Before enabling Force HTTPS, check whether your SSL certificate is already installed.
Hostinger states that Lifetime SSL is automatically installed on websites using eligible Web and Cloud hosting plans. Once SSL is installed, HTTPS is forced by default on supported plans.
Step 1: Log in to Hostinger
Open Hostinger hPanel and sign in using your account credentials.
Step 2: Open your website dashboard
Navigate to the Websites section. Find the website you want to secure and click Manage site or the corresponding dashboard option.
Step 3: Open SSL settings
In the sidebar, search for SSL and open the SSL management page.
Step 4: Check the certificate status
Find your domain or subdomain and review its SSL status.
Depending on your setup, you may see an active certificate, an installation status, or an error that needs attention.
Step 5: Install SSL if necessary
If your domain does not have a certificate, use the available Install SSL option when eligible. Follow the on-screen instructions and wait for installation to complete.
If you are using a custom SSL certificate, use the custom certificate installation process and make sure the certificate matches your domain.
Related guide: How to Install an SSL Certificate on Hostinger.
5. How to Force HTTPS on Hostinger Using hPanel
Once your SSL certificate is active, you can check or enable the Force HTTPS setting through Hostinger's SSL management page.
Follow these steps:
Step 1: Open Hostinger hPanel
Visit Hostinger hPanel and log in to your account.
Step 2: Go to Websites
Open the Websites section and find the domain for which you want to force HTTPS.
Click Manage site to open the website dashboard.
Step 3: Open SSL settings
Use the sidebar to find and open the SSL section.
You will see the domains or subdomains associated with the website and their SSL information.
Step 4: Find your domain
Locate the domain for which you want to enable HTTPS. Confirm that the SSL certificate is installed and active.
Step 5: Select Force HTTPS
Click the three-dot menu (⋮) next to the relevant domain or subdomain.
If HTTPS is not currently forced, select Force HTTPS from the available options.
Step 6: Test your website
Open the HTTP version of your domain in a browser:
http://yourdomain.comCheck whether it automatically redirects to:
https://yourdomain.comImportant: On supported Hostinger Web and Cloud hosting plans, HTTPS is enabled by default once SSL is installed. You may already see the option Unforce HTTPS instead of Force HTTPS. This means HTTPS forcing is already enabled.
Hostinger's official instructions: How to Enable or Disable HTTPS for Your Website at Hostinger.
6. How to Force HTTPS on WordPress Websites Hosted on Hostinger
If your website runs on WordPress, enabling HTTPS at the hosting level may not be enough. You should also check the WordPress Address and Site Address settings.
These settings tell WordPress which URL should be used for the website and its administration area.
Step 1: Make sure SSL is active
Follow the SSL installation steps explained earlier. Confirm that your domain can load using HTTPS before changing WordPress URLs.
Step 2: Log in to WordPress
Open your WordPress administration area:
https://yourdomain.com/wp-adminLog in using your WordPress username and password.
Step 3: Open General Settings
From the WordPress dashboard, navigate to:
Settings → GeneralStep 4: Update WordPress Address and Site Address
Find these two fields:
- WordPress Address (URL)
- Site Address (URL)
If they currently use HTTP, change them to HTTPS.
For example:
| Setting | Before | After |
|---|---|---|
| WordPress Address | http://example.com | https://example.com |
| Site Address | http://example.com | https://example.com |
Make sure both fields use your intended primary domain version, including the same www or non-www format.
Step 5: Save the changes
Scroll down and click Save Changes.
WordPress will now use the HTTPS version in its main website URL settings.
Step 6: Check the website
Open your homepage and several internal pages. Confirm that they load using HTTPS without certificate warnings or missing content.
Official Hostinger guide: How to Force HTTPS on WordPress Websites at Hostinger.
7. How to Redirect HTTP to HTTPS Using .htaccess
If you need to manage HTTPS redirects manually, you may be able to use the .htaccess file on Apache-compatible hosting environments.
This method is useful when you need a custom redirect rule or are troubleshooting an existing website configuration.
Step 1: Open File Manager
- Log in to Hostinger hPanel.
- Open Websites and manage your website.
- Find File Manager in the dashboard.
- Open the
public_htmldirectory.
Step 2: Find the .htaccess file
Look for the .htaccess file in your website's root directory.
If you cannot see it, check whether hidden files are displayed in File Manager.
Step 3: Create a backup
Download a copy of the current file or copy its contents into a separate document before editing.
Step 4: Add the HTTPS redirect rule
For a typical Apache configuration, the following rule redirects HTTP requests to HTTPS:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]The rule checks whether the current request is using HTTPS. If it is not, the browser receives a permanent redirect to the HTTPS version of the same URL.
Step 5: Save and test
Save the changes and open the HTTP version of your website. Check whether the browser redirects to HTTPS correctly.
8. How to Verify That HTTPS Is Working
After enabling Force HTTPS, verify the website from a visitor's perspective. A successful setting change does not automatically mean every page and resource is configured correctly.
1. Open the HTTP version
Enter your website using the HTTP address:
http://yourdomain.comIt should automatically redirect to the HTTPS version.
2. Check the browser address bar
After the redirect, confirm that the address starts with:
https://Click the browser's site information or connection icon to inspect the connection and certificate details.
3. Test the www version
If your website supports both www and non-www versions, test them separately.
http://yourdomain.com
http://www.yourdomain.comBoth should reach your preferred HTTPS version if that is how your domain is configured.
4. Check internal pages
Open several pages, such as your About, Contact, Blog, and product pages. Make sure each one loads securely.
5. Check the certificate
Use your browser's certificate information to confirm that the certificate is valid and covers the domain being visited.
You can also use Qualys SSL Labs to inspect the publicly accessible SSL/TLS configuration of your website.
9. How to Fix Mixed-Content Errors on Hostinger
Sometimes a website loads over HTTPS but still displays browser warnings or looks broken. This can happen because of mixed content.
Mixed content occurs when an HTTPS page loads some resources using an insecure HTTP address.
For example, your website may load through:
https://example.comBut an image, stylesheet, script, font, or embedded resource may still use:
http://example.com/wp-content/uploads/image.jpgBecause the resource is requested over HTTP, the browser may block it or display a warning.
Common causes of mixed content
- Old image URLs stored with HTTP.
- Hard-coded HTTP links inside website themes.
- Plugins loading scripts or stylesheets through HTTP.
- External fonts, videos, or embedded content using insecure URLs.
- Old database links left behind after a website migration.
How to fix mixed content in WordPress
Step 1: Check the browser console
Open your website in Chrome, press F12, and select the Console tab. Look for mixed-content warnings that identify resources still loading through HTTP.
Step 2: Identify the affected resources
Check whether the insecure URLs belong to images, scripts, stylesheets, fonts, plugins, or external services.
Step 3: Update insecure URLs
Update old HTTP resource addresses to HTTPS where the resource supports it. Check theme settings, plugin settings, and any hard-coded website links.
Step 4: Review database URLs carefully
If old HTTP URLs are stored in the WordPress database, use a compatible search-and-replace method to update them. Back up your database before making bulk changes.
Step 5: Clear website caches
Clear WordPress caching plugins, Hostinger cache, CDN cache, and browser cache where applicable.
Step 6: Test the website again
Reload the affected pages and inspect the browser console. Confirm that insecure resource requests have been resolved.
Official guide: How to Fix the Mixed Content Error on WordPress at Hostinger.
10. Common HTTPS Problems on Hostinger and Their Solutions
If your website still does not work correctly after enabling HTTPS, check the symptoms below to identify the possible cause.
| Problem | Possible reason | What to do |
|---|---|---|
| Force HTTPS option is missing | SSL is not installed, the site uses a different product, or the plan does not support the same control. | Check the SSL status and your website type. |
| SSL certificate is not active | Domain pointing, DNS conflicts, or installation issues. | Verify DNS and follow Hostinger's SSL troubleshooting instructions. |
| Website still loads using HTTP | HTTPS forcing is not enabled or another configuration controls redirects. | Check hPanel and existing redirect rules. |
| ERR_TOO_MANY_REDIRECTS | Conflicting redirects between hosting, WordPress, or a CDN. | Review all redirect settings and remove duplicate rules. |
| Mixed-content warning | Some resources still load through HTTP. | Update insecure image, script, stylesheet, and font URLs. |
| SSL certificate warning | Invalid, expired, or mismatched certificate. | Check certificate status, hostname coverage, and renewal. |
| Website works on www but not non-www | Certificate or domain redirect configuration is incomplete. | Check both hostnames and the preferred domain setup. |
| HTTPS works on homepage but not inner pages | Page-specific resources or redirect rules are incorrect. | Test individual pages and inspect their URLs. |
Fix ERR_TOO_MANY_REDIRECTS
This error appears when your website keeps redirecting visitors between different URLs without reaching a final page.
For example:
HTTP → HTTPS → HTTP → HTTPSThis can happen when multiple systems try to control the same redirect.
To troubleshoot the issue:
- Check the Force HTTPS setting in Hostinger.
- Review the WordPress Address and Site Address settings.
- Check redirect plugins and custom server rules.
- Review the SSL or proxy mode if you use Cloudflare.
- Remove conflicting HTTP-to-HTTPS or HTTPS-to-HTTP rules.
- Clear relevant caches and test again.
Fix an invalid or expired SSL certificate
If your certificate is invalid or expired, check whether it covers the correct domain and whether its renewal or installation has failed.
If you use a custom SSL certificate, make sure it is renewed before expiry. Hostinger warns that an invalid or expired custom certificate can make a website inaccessible while HTTPS is being forced.
Official troubleshooting: How to Fix Connection Not Secure or Not Private Errors at Hostinger.
11. How to Disable Force HTTPS on Hostinger
In most cases, keeping HTTPS enabled is recommended. However, you may need to temporarily disable the forced redirect when troubleshooting a redirect loop or testing a specific configuration.
Hostinger allows supported Web and Cloud hosting users to unforce HTTPS through the SSL management page.
Steps to disable Force HTTPS
- Log in to Hostinger hPanel.
- Open Websites and manage the relevant website.
- Navigate to the SSL section.
- Find the domain or subdomain you want to change.
- Click the three-dot menu (⋮) beside it.
- Select Unforce HTTPS.
- Test the website using both HTTP and HTTPS.
This makes HTTP available from Hostinger's hosting-level redirect perspective. It does not necessarily remove the SSL certificate.
Force HTTPS vs uninstall SSL
These are two different actions:
| Action | What it does |
|---|---|
| Unforce HTTPS | Stops Hostinger's automatic HTTP-to-HTTPS redirect. |
| Uninstall SSL | Removes the SSL certificate from the website. |
Do not uninstall your SSL certificate simply because you want to test the HTTP version of a website. Unforcing HTTPS is a separate and less disruptive setting.
12. Frequently Asked Questions
1. What does Force HTTPS mean in Hostinger?
Force HTTPS redirects visitors from the HTTP version of your website to the secure HTTPS version. It helps ensure that visitors use an encrypted connection when accessing your website.
2. Does Hostinger automatically enable HTTPS?
Yes. According to Hostinger, when an SSL certificate is installed on a website using a supported Web or Cloud hosting plan, HTTPS is enabled and forced by default. You can verify its status through hPanel's SSL settings.
3. Do I need an SSL certificate to force HTTPS?
Yes. Your website needs a valid SSL/TLS certificate for the domain before visitors can establish a secure HTTPS connection without certificate warnings.
4. How do I force HTTPS on a WordPress website hosted on Hostinger?
First, make sure SSL is installed and active. Then check Hostinger's Force HTTPS setting and update the WordPress Address and Site Address under Settings → General so both use HTTPS.
5. Why does my website show a Not Secure warning even after enabling HTTPS?
The SSL certificate may be invalid, expired, or incorrectly configured. Another possibility is mixed content, where some page resources still load through HTTP. Check the certificate status and browser console.
6. Does forcing HTTPS improve SEO?
HTTPS is a lightweight Google ranking signal and a recommended website security practice. However, it does not guarantee higher rankings. You should also maintain correct redirects, canonical URLs, internal links, and website content.
7. Can I force HTTPS without editing the .htaccess file?
Yes. On supported Hostinger Web and Cloud hosting plans, you can manage HTTPS through the SSL section in hPanel. Manual redirect rules are only needed for certain custom configurations.
8. Why does my website show ERR_TOO_MANY_REDIRECTS?
This usually happens because two or more systems are applying conflicting redirect rules. Check Hostinger's Force HTTPS setting, WordPress URLs, redirect plugins, server rules, and CDN configuration.
9. Does Unforce HTTPS remove my SSL certificate?
No. Unforce HTTPS disables Hostinger's forced redirect but does not necessarily uninstall the SSL certificate. Removing the certificate is a separate action.
10. Can I force HTTPS on a Hostinger Agency Hosting plan?
Hostinger's current documentation states that the Force HTTPS and Unforce HTTPS controls are not available on Agency Hosting plans. Agency Hosting users can install or uninstall SSL certificates, but the standard forcing control is not provided in the same way.
Secure Your Hostinger Website With HTTPS
Using HTTPS helps protect visitor information, improve trust, and maintain a consistent secure version of your website.
Check your SSL certificate, enable Force HTTPS through hPanel, and verify that your WordPress URLs and website resources use HTTPS correctly.
Explore Hostinger SSL GuidesEditorial note: Hostinger dashboard labels and available HTTPS controls may vary depending on your hosting plan and website type. This guide primarily covers supported Web and Cloud hosting setups. Always confirm that SSL is active before enabling forced HTTPS, and back up your website before changing WordPress URLs or server configuration.
