Really Simple SSL on specific pages

On a half-secure site, the first thing to decide is the home page

Your site could run entirely on HTTPS except for one page: the one embedding an old service that does not accept secure connections. Or the other way around: you only need to encrypt the contact form and the client area, and you would rather leave the rest as it is for now. The best outcome would be for that service to support HTTPS, but until it does you need a way out, page by page.

What often gets overlooked is where the home page stands. Choosing pages is the easy part; what shapes the result is whether the home page runs on HTTPS. When a browser loads the domain root over a secure connection, it may start forcing subpages as well, and it also remembers that the site was on SSL. That is why Really Simple SSL per page treats the home page as a special case, with its own setting.

Two modes for deciding page by page

• Add pages to SSL: everything runs on HTTP except what you mark.
• Exclude pages from SSL: with this option, everything runs on HTTPS except what you mark.
• A checkbox on each edit screen: "This page on https", in a side box.
• Bulk changes: the Make HTTP and Make HTTPS actions in the list.
• An icon column in the list, clicked to switch a page.
• All public content types, not only pages: also posts and custom types.

How it redirects and what it leaves out

The plugin redirects from the server and in both directions: it sends marked pages to HTTPS and unmarked ones to HTTP. Anyone who wants only the first half can disable the redirect to HTTP with the RSSSL_NO_HTTP_REDIRECT constant.

The redirect is temporary (302) until you enable Redirect permanently, which turns it into a 301. That is the best option for SEO, but it comes switched off because it complicates changes while you configure. Leave it for the end, once the split of pages is settled.

The admin area, AJAX requests and previews, including those from Elementor and Divi, stay outside the redirects.

The Auto replace mixed content option swaps insecure addresses for secure ones, and it appears only when the plugin detects SSL on the site. If you leave a page on HTTP precisely because of a frame from a service without HTTPS, check that page by hand after configuring it, in a private window so the browser does not use what it remembers.

Certificate, HSTS and firewall are handled elsewhere

You need a certificate on the server: among its settings there is no certificate generation. There is no HSTS setting either, and if your server already sends that header, browsers may force HTTPS on their own.

Among its settings there is no firewall or login protection either. And it does not coexist with the free version of Really Simple SSL: it is installed in its place.

Minimum versions and a page-by-page start

It requires at least WordPress 4.9 and PHP 5.6, plus a certificate on the server. Since the redirect applies to real visits, test first on a copy with your current WordPress and PHP versions. Then:

1. Deactivate the free version of Really Simple SSL if you have it.
2. Upload the plugin file and activate it.
3. Under Settings, SSL, decide whether you add pages or exclude them, and set Homepage on SSL.
4. Mark the pages, one at a time or in bulk.
5. Check each one in a private window and enable Redirect permanently when finished.

When what you want is HTTPS across the whole site

If the service holding you back now supports HTTPS, a plugin for the whole site is more direct. WP Force SSL PRO brings together 301 redirects, a content scanner, mixed content fixing and HSTS. Really Simple SSL Pro enables HTTPS and generates Let's Encrypt certificates, and it is also a security suite with a firewall and two-factor authentication. Among the features they bring there is no splitting of pages between HTTP and HTTPS.

Home page, 301s and pages still on HTTPS

Can I have the home page on HTTPS and a subpage on HTTP?

The home page has its own setting, but a browser entering the root over HTTPS may force subpages too. Test it on your site before relying on it.

When do I enable the 301 redirect?

When you finish configuring. It comes switched off so test changes stay simple.

Why do I still see HTTPS on an excluded page?

Browsers remember that the site was on SSL. Try a private window and check how the home page setting stands.