To force HTTPS on Hostinger, install the free SSL certificate first (hPanel → Security → SSL → Install next to your domain), then turn on the Force HTTPS toggle on the same screen — from that moment every HTTP request is 301-redirected to HTTPS automatically. If the toggle is missing or you need exceptions for specific paths, add a rewrite rule to .htaccess instead. After forcing HTTPS, check for mixed content (insecure http:// images, scripts, or stylesheets loading on secure pages) and fix the URLs to https://, because browsers block or warn on those.
Prerequisites: SSL must be installed first
Forcing HTTPS with no certificate installed gives visitors a security error instead of your site — order matters. In hPanel go to Security → SSL, find your domain, and confirm the certificate status shows installed/active. On current Hostinger web and cloud plans the free Lifetime SSL is usually provisioned automatically when the website is created; if it is missing or expired, click Install (or Reinstall) and wait a few minutes. Only proceed once https://yourdomain.com loads cleanly in a browser with the padlock showing. For the full walkthrough, see our free SSL installation guide — this post picks up where that one ends.
Method 1 — The Force HTTPS toggle (recommended)
Step 1: In hPanel, open Security → SSL.
Step 2: Find your domain in the list and switch the Force HTTPS toggle on.
Step 3: Test in a private/incognito window: type http://yourdomain.com (deliberately plain HTTP) and confirm the browser lands on the https:// version with a padlock.
That is the whole method. Hostinger handles the server configuration; every HTTP URL on that domain now 301-redirects to its HTTPS twin. Do this for each domain and subdomain individually — the toggle is per-domain, not account-wide.
Method 2 — .htaccess rule (full control)
Use this if the toggle is unavailable on your plan, if you need to exclude certain paths from HTTPS, or if you simply prefer explicit rules. In hPanel go to Files → File Manager, open the domain’s folder (public_html for the primary domain), enable Show Hidden Files if .htaccess is invisible, and download a backup copy first — a syntax error here can break the site, and the backup is your instant undo.
Add this near the top of .htaccess, before WordPress’s own block if present:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Do not combine this with the hPanel toggle — pick one method. Two HTTPS-forcing layers is the most common cause of “too many redirects” errors on Hostinger. If you already enabled the toggle, leave .htaccess alone.
WordPress sites: update the site URLs too
On WordPress, the server redirect is only half the job — WordPress itself must generate HTTPS links, or you will chase mixed-content warnings forever. In wp-admin go to Settings → General and make sure both WordPress Address (URL) and Site Address (URL) start with https://. If they still show http://, change them and save (you will be logged out and back in — normal).
Then fix old content: years of posts may contain hardcoded http://yourdomain.com/wp-content/... image and link URLs. The safe way is the Better Search Replace plugin (dry-run first): search http://yourdomain.com, replace with https://yourdomain.com, selecting the relevant tables. Back up the database before running it for real — search-replace on a live database is not the place for improvisation.
Fixing mixed content warnings
Mixed content means the page loaded over HTTPS but pulls some resources over HTTP — an image, a script, a stylesheet, a font. Browsers handle it in two tiers: passive mixed content (images, video) usually still loads but the padlock shows a warning; active mixed content (scripts, iframes, stylesheets) is blocked outright, which visibly breaks pages.
Step 1 — Find the culprits. Open the page, press F12 for dev tools, and look at the Console tab — every blocked or warned resource is listed with its http:// URL. The Security tab summarizes the page’s mixed-content state.
Step 2 — Fix the URLs. In order of preference:
- Update the source: edit the post, widget, or theme setting to use the https:// URL (or a protocol-relative
//URL). This is the real fix. - Database search-replace: for hardcoded http:// URLs scattered across old content (see the WordPress section above).
- Content-Security-Policy header: as a safety net,
upgrade-insecure-requeststells browsers to silently upgrade http:// subrequests to https://. Add via .htaccess:Header always set Content-Security-Policy "upgrade-insecure-requests;". Useful, but treat it as a backstop — fix the URLs themselves first, because third-party resources that lack HTTPS will still fail.
Step 3 — Re-check. Hard-refresh (Ctrl+Shift+R) or test in a private window; the padlock should be clean with no console warnings.
Common problems after forcing HTTPS
“Too many redirects.” Two HTTPS-forcing layers are active (toggle + .htaccess rule, or a WordPress plugin like Really Simple SSL duplicating the server redirect). Keep exactly one. If Cloudflare sits in front, its SSL mode must be Full (strict) — “Flexible” with a server-side HTTPS rule is the classic infinite loop.
“Some pages show ‘Not secure’.” That is mixed content on those specific pages — run the dev-tools console check on each affected page rather than assuming the whole site is broken.
“The toggle is on but http:// still loads.” Browsers cache 301 redirects aggressively: the browser may be showing you a cached pre-toggle response. Test in a private window. If it genuinely still serves HTTP, check for a conflicting .htaccess rule or a caching plugin serving stale HTTP pages — purge all caches (plugin + Hostinger’s cache in hPanel if enabled).
“External embeds broke.” Third-party widgets, feeds, or scripts that only exist over HTTP cannot be upgraded — contact the provider for an HTTPS endpoint or replace the embed. This is rare in 2026 but still happens with legacy tools.
FAQ
Is Hostinger’s SSL really free?
Yes — every web and cloud hosting plan includes free Lifetime SSL certificates for all domains and subdomains on the plan, auto-installed in most cases. There is nothing to buy and no annual renewal to remember for the basic certificate.
Do I still need to force HTTPS if SSL is installed?
Yes. Installing the certificate only enables HTTPS; without forcing it, the HTTP version of your site keeps working and visitors, bookmarks, and old links keep using the insecure version. The toggle (or .htaccess rule) is what actually moves everyone to HTTPS.
Will forcing HTTPS hurt my SEO?
The opposite — HTTPS is a confirmed (minor) ranking signal, Chrome labels HTTP pages “Not secure,” and the 301 redirect passes ranking signals to the HTTPS URLs. Do update your sitemap and Search Console property to the HTTPS version after the switch.
How do I check that HTTPS is working everywhere?
Load the homepage and a few inner pages in a private window and confirm the padlock with no warnings, deliberately visit an http:// URL to confirm it redirects, and run the site through an SSL checker (ssllabs.com/ssltest) for the certificate chain. Then spot-check the dev-tools console for mixed content on your most important pages.
Next steps
HTTPS is one layer of a trustworthy site: our free SSL guide covers installation and renewal edge cases in depth, and if you are moving a domain onto Hostinger in the first place, connecting a domain to Hostinger walks through the DNS side. For WordPress specifically, installing WordPress on Hostinger sets the HTTPS site URLs correctly from the start.