WowCodesDocs
Knowledge base

Switch to HTTPS or change your site address

Turning on HTTPS takes a certificate at your host, two lines in .htaccess and one setting in your admin panel. The same setting, Site URL, is what you change when your store's address changes.

Switch the store to HTTPS

  1. Turn on SSL at your host

    Add a certificate for your domain in your hosting account, and check that https:// opens your store.

  2. Send every visit to HTTPS

    On Apache or LiteSpeed, open .htaccess in your site folder, find the "Force HTTPS" lines near the top, and remove the # at the start of the two lines under it:

    .htaccess
    # Force HTTPS — enable on production by removing the leading '#' on the two lines below
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    Core updates never overwrite your .htaccess, so the change stays.

  3. Change the Site URL

    In Settings General, change Site URL to start with https://, and save. See the next section.

  4. Update your provider dashboards

    Copy the new return and webhook addresses into each payment provider, and the new redirect addresses into Google, Facebook or Apple sign-in if you use them. See Set up a gateway's return and webhook addresses. Rewards (coins-only) stores have no payment gateways, so only the sign-in providers apply there.

Browsers remember HTTPS

Once a visitor has opened your store over HTTPS, the store tells their browser to keep using HTTPS for a year, for your domain and its subdomains. Make sure any subdomain you use also has a certificate.

Optional: secure sign-in cookies

Once the whole store is on HTTPS, you can make the sign-in cookie HTTPS-only. In .user.ini in your site folder, remove the ; in front of this line:

.user.ini
session.cookie_secure = 1

Don't do this before HTTPS works: sign-in over plain http:// stops working. PHP reads .user.ini on PHP-FPM and CGI setups, and picks up a change within a few minutes.

HTTPS that ends at a proxy

If HTTPS is handled by a proxy or CDN in front of your server, list its addresses in TRUSTED_PROXY_IPS in your .env file. The store then believes the proxy when it says the visit came over HTTPS.

Change the Site URL

Settings General Site URL is the address every emailed link is built on, including password-reset links, invites and unsubscribe links in scheduled campaigns. Payment gateways and social sign-in build their addresses from it too.

  • Only an Administrator can change it.
  • Use a plain web address: https://example.com, with no password, ? or # part.
  • Without it, password-reset emails aren't sent to anyone, and scheduled campaigns can't build their unsubscribe links and don't send.

"Saved, but payment gateways keep using the address each payment starts on"

Gateways only switch to a new Site URL once it's confirmed as your store's real address. If you see this message, either the Site URL starts with a different scheme (http or https) from the one you're using, or it names a different folder. Open your admin panel at the Site URL itself, or correct the address, and save again.

If you can't sign in to change it

Whoever has shell access to the server can set the Site URL from your site folder:

Shell
php bin/set-site-url.php https://your-store.example

It checks the address, saves it, confirms it for the payment gateways, and records the change in the Admin Log. The admin's Forgot password? page shows the same command when no Site URL is set.

Something wrong or unclear on this page? Tell us at [email protected], or see how to get help.