How to Install an SSL Certificate on WordPress Multisite

In this tutorial, you will learn how to install an SSL certificate on WordPress Multisite. There are two parts: install the certificate at the server level (the type depends on whether your network uses subdirectories, subdomains, or separate domains), then force HTTPS across the whole network from inside WordPress.

Which SSL certificate does your Multisite need?

WordPress Multisite is a native WordPress feature that lets you create and manage multiple sites from a single installation and dashboard. You can set up a network in one of three layouts: subdirectories, subdomains, or separate domains. The layout decides which certificate you need, because each one secures host names differently. If you are not sure which certificate fits your setup, use our SSL Wizard to find a suitable product for your project and budget.

Multisite as subdirectories

A subdirectory (also called a subfolder) is a path within a single domain. For example:

• yoursite.com/blog
• yoursite.com/store
• yoursite.com/membership

Because every subsite lives under the same host name, a single standard SSL certificate for that domain secures the entire network. If your main domain already runs on HTTPS, the subdirectory sites are covered automatically, with no extra certificate to buy.

Multisite as subdomains

A subdomain is a section that sits in front of the root domain. Subdomains are a practical way to separate parts of a network. For example:

• blog.yoursite.com
• store.yoursite.com
• membership.yoursite.com

For a network that runs on subdomains, a Wildcard SSL certificate is the right fit. A Wildcard secures the root domain plus an unlimited number of first-level subdomains under it, all on one certificate. You can add new subsites at any time, and they are covered without reissuing the certificate.

Note: a Wildcard covers one level of subdomains. A certificate for *.yoursite.com secures blog.yoursite.com but not shop.blog.yoursite.com. If your network nests subdomains that deep, plan for that level separately.

Multisite as different domains

If you want each subsite to use its own custom domain, you first map the domains. Domain mapping has been built into WordPress core since version 4.5, so a separate mapping plugin is no longer required. You map a domain by editing the subsite under Network Admin > Sites > Edit and setting its Site Address (URL) to the custom domain (your DNS and server must already point that domain at the network).

Once your domains are mapped, secure them with a multi-domain SSL certificate. A multi-domain certificate (also called a SAN certificate) covers several unrelated domains by default and accepts additional Subject Alternative Names on request, so one certificate and one renewal protect the whole network. Servers that host multiple HTTPS sites on one IP rely on SNI (Server Name Indication) to present the correct certificate per host name, which every current browser and server supports.

Install the certificate on your server

WordPress does not install the certificate itself. You install it on the server or host that runs the network, then switch WordPress to HTTPS. The exact steps depend on your environment:

• Managed or shared hosting: upload or paste the certificate, private key, and CA bundle in your control panel (cPanel, Plesk, or the host’s SSL/TLS screen). Many managed WordPress hosts install and renew certificates for you.
• Apache: point SSLCertificateFile and SSLCertificateKeyFile at your full-chain certificate and key inside the port 443 VirtualHost. See our install guides for the exact directives.
• Nginx: set ssl_certificate (full chain) and ssl_certificate_key in the server block that listens on 443.

Need the certificate first? Generate the request with our CSR Generator, or follow a step-by-step CSR tutorial for your platform. After the Certificate Authority issues the files and you install them, confirm the certificate is live with our SSL Checker before moving on.

Enable HTTPS across the Multisite network

With the certificate installed on the server, the last step is to make WordPress serve every site over HTTPS. Back up your database and files before you start, because these changes touch site URLs across the whole network.

Step 1: Update the site and home URLs to https

In Network Admin > Sites, open each subsite, go to the Settings tab, and change Siteurl and Home from http to https. For the main site you can also set this under its own Settings > General screen (the WordPress Address and Site Address fields). Save each site after editing.

Step 2: Force HTTPS for the admin and login

Edit wp-config.php in the network root and add this line above the comment that reads /* That’s all, stop editing! Happy publishing. */:

define( 'FORCE_SSL_ADMIN', true );

This sends every login and admin session over HTTPS across the network. Only add it after the certificate is working on the server, otherwise the admin area can become unreachable.

If the network sits behind a reverse proxy or load balancer that terminates SSL (common on managed hosting and CDNs), WordPress may not detect HTTPS and can loop on redirects. In that case, tell WordPress to trust the forwarded protocol header by adding this just above the same line:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
    $_SERVER['HTTPS'] = 'on';
}

Step 3: Replace hardcoded http URLs in the database

Existing posts, menus, and settings often store full http links. Run a search-and-replace so those become https. The safest tool is WP-CLI, which handles serialized data correctly and can target the whole network:

wp search-replace 'http://yoursite.com' 'https://yoursite.com' --network --skip-columns=guid --dry-run

Review the dry-run output, then run the command again without –dry-run to apply the change. Repeat for each distinct domain in a network that uses separate or subdomain sites. If you do not have WP-CLI access, a maintained plugin such as Better Search Replace performs the same job from the dashboard. Leave the guid column alone, since changing it can affect feed readers.

Step 4: Verify and (optionally) redirect

Load each site and confirm the padlock shows with no mixed-content warnings in the browser console. A force-HTTPS plugin such as Really Simple SSL (which supports Multisite) can catch any remaining insecure requests and add the HTTP to HTTPS redirect for you. You can also handle the redirect at the server level in your Apache or Nginx config. For a full walkthrough of moving a site to HTTPS, see our guide on switching from HTTP to HTTPS.

Your WordPress Multisite network now serves every site over HTTPS.

Frequently Asked Questions