Force HTTPS in WordPress without a plugin pile

To force HTTPS in WordPress, set both the site URL and home URL to https://, then add one server-level redirect from HTTP to HTTPS. That pair of steps is enough for most sites once AutoSSL has issued a valid certificate. Extra force-HTTPS plugins stacked with CDN rules and more .htaccess redirects are a common way to create redirect loops.

Set siteurl and home to HTTPS

WordPress builds admin links, front-end URLs, and cookies from two stored values: siteurl and home. Both should match your canonical HTTPS address, including whether you use www. You can set them in the database through WP-CLI or Settings, or lock them in wp-config.php so nothing rewrites them later.

wp option get siteurl
wp option get home

Both commands should print an https:// address. If they still print http://, the admin will keep generating insecure links and cookies will flip between schemes. After you correct the values, purge LiteSpeed Cache so cached pages pick up the change.

If a plugin keeps writing http:// back into the options table, define WP_HOME and WP_SITEURL as constants in wp-config.php. Constants win that argument and stop the drift.

Add one redirect after AutoSSL is ready

Wait until AutoSSL or Let’s Encrypt shows a valid certificate before you force the redirect. Doing it earlier only serves browser warning pages while the cert is still pending. On our shared hosting stack, a single LiteSpeed or .htaccess 301 from HTTP to HTTPS on the canonical host is the right place for that rule.

Do not add a second redirect on top of one you already have. WP Toolkit’s force HTTPS control does the same job: it updates those two options and installs one redirect. Use it once, then verify siteurl and home still show https://.

Clean mixed content, then consider HSTS

A server redirect does not rewrite old HTML, CSS, or media URLs stored as http:// inside posts and page builders. Run a careful search-replace for leftover http links in content after the options and redirect are correct. Mixed content on background images or scripts is a content problem, not a missing plugin.

Only after the certificate, the two options, one 301, and content cleanup are solid should you think about HSTS. Preload is a later decision and is hard to undo. On WordPress hosting here, AutoSSL plus those two options and one redirect is the whole move for a typical site.