WP Encryption – One Click SSL & Force HTTPS (Premium)

The free certificate is paid for with a task every 90 days

You generated a Let's Encrypt certificate, installed it, saw the padlock and moved on. That certificate expires after 90 days. If renewal stays in your hands, you have a recurring task that does not forgive a lapse: when it expires, the site shows as insecure to every visitor.

The certificate costs no money, but it has a calendar cost that repeats for as long as the website exists. WP Encryption Premium, a WordPress plugin for generating, installing and maintaining Let's Encrypt certificates, targets exactly that point: it renews on its own, 30 days before expiry. It is worth knowing the conditions, because full automation depends on what your hosting looks like.

What gets automated, and on what condition

In the free version, installation and renewal are done by hand. Premium changes the following:

• Domain verification: goes from manual to automatic, via HTTP or DNS.
• Installation: automatic on cPanel sites. Outside cPanel an initial server setup is needed, and on a VPS or dedicated server you can download the certificate files and install them over SSH.
• Renewal: automatic, 30 days before expiry.
• Wildcard certificate: for the primary domain. Full automation requires DNS managed by cPanel or GoDaddy.

These are Let's Encrypt domain-validated certificates. Beyond the site itself, the plugin can enable HTTPS for webmail and email.

Forcing HTTPS without trapping the site in a loop

Installing the certificate and requiring it are two separate steps, and the second is the one that can lock you out if it comes too early. Check that the certificate is valid at your HTTPS address and only then turn on forcing.

• 301 redirect via .htaccess at server level, in one click. This is the recommended method for speed.
• Redirect via WordPress, meant for sites behind Cloudflare or other reverse proxies.
• Redirect loop fix for Cloudflare, StackPath, load balancers and reverse proxies.
• Mixed content scanner and fixer, for the insecure requests that stop the padlock from showing.

A security layer on top of the certificate

The plugin has grown beyond SSL, and this part may overlap with the security plugin you already use:

• SSL health page: a site score, HSTS, HttpOnly secure cookies and advanced security headers.
• Passkey login (WebAuthn), with no passwords.
• Daily scans for vulnerabilities, malware and integrity, with notifications when a problem appears.
• Multisite: subdirectory and subdomain networks, and mapped domains, with each domain's certificates in a separate directory.

Installing on Linux hosting

You need Linux hosting with OpenSSL, cURL and allow_url_fopen enabled.

1. Back up the site and the database.
2. Upload the plugin to wp-content/plugins and activate it.
3. Open WP Encryption in the side menu and follow the wizard.
4. Run the install form once to install SSL.
5. Check that the certificate is valid at your HTTPS address before forcing HTTPS.

Other ways to handle HTTPS in the catalog

WP Encryption centers its value on issuing, installing and renewing the certificate. If you already have a certificate, you can use it just for the Force HTTPS redirect; if your hosting already renews, you are left with the redirect and the security layer, and it is worth comparing these options:

• WP Force SSL PRO, by WebFactory, combines the 301 redirect, a content scanner that goes through the whole site and mixed content fixing. It also generates Let's Encrypt certificates.
• Really Simple SSL Pro is a security suite with a firewall, two-step authentication and login attempt limits. It suits you when you want general security and HTTPS is just one part of it.

When the server does not cooperate

Is HTTPS active instantly?

It depends on the server. Installing the certificate is a server-side process, and only on cPanel does the plugin do it automatically.

The renewed certificate does not show and I do not use cPanel. What should I do?

Reboot the server instance once.

How do I go back if forcing HTTPS breaks access?

Forcing can be temporarily disabled from wp-config.php. Also remove any other HTTPS enforcement rule from .htaccess.