The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
To use a custom certificate on WordPress, install the certificate, matching private key, and any intermediate chain on the server, load them in the HTTPS virtual host or reverse proxy, and then change WordPress’s public URLs to https://. WordPress does not upload or activate certificates itself. The web server, load balancer, CDN, or hosting control panel that terminates TLS does that work.
Once the HTTPS endpoint works, force administrator sessions over HTTPS, configure forwarded protocol and host headers if TLS ends at a proxy, and test for redirect loops, certificate errors, and mixed-content URLs. The procedure below covers Apache, Nginx, managed TLS interfaces, and proxied WordPress installations.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What “SSL on WordPress” actually means
“SSL” is the familiar name for the HTTPS certificate system; current deployments use TLS. The certificate encrypts traffic between a visitor and the TLS endpoint and proves that the endpoint is authorized for the requested hostname. WordPress is HTTPS-compatible when a TLS certificate is installed and available for the web server to use, but WordPress itself is not the certificate manager.
In a conventional installation, Apache or Nginx listens on TCP port 443, presents the certificate, decrypts the request, and passes it to PHP and WordPress. In another design, a load balancer, CDN, or edge proxy handles TLS and forwards the request to an HTTP-only WordPress server. In both cases, the certificate and private key belong at the TLS terminator, not in the media library, a public page, or an arbitrary plugin field.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Changing WordPress URLs before the HTTPS endpoint is ready can lock you out. Conversely, enabling HTTPS at the server while WordPress still advertises HTTP can produce insecure links and cookies. Treat the server change and the WordPress URL change as two coordinated stages.
Prepare an inventory before making changes
Write down the answers to these questions before uploading anything:
- Where does TLS terminate? Identify Apache, Nginx, a hosting panel, load balancer, CDN, or another proxy that owns the public port 443 listener.
- Which hostname is public? Confirm every hostname visitors use, such as
example.comandwww.example.com, is covered by the certificate’s names. Decide which one is canonical. - Do you have the complete chain? Obtain the intermediate certificate bundle supplied by the issuer. A server certificate without the required chain may work for one browser and fail for another.
- Can you recover access? Keep an administrator account, an out-of-band shell or hosting-panel path, and a recent database and file backup. URL constants can override database values and can make the dashboard appear unreachable until they are removed.
- How will you test and reload? Confirm the operating system’s configuration-test and service-reload procedure. Commands differ between distributions and managed platforms, so do not paste an example command without checking your environment.
Store certificate files outside the public document root. The private key should be readable only by the account or group that the TLS service requires. Never place the key in a WordPress upload directory, commit it to a repository, or paste it into a page, ticket, or publicly visible settings field.
Install the custom certificate at the TLS terminator
Apache
Copy the certificate and key to protected paths on the Apache host, along with the issuer’s intermediate chain if your distribution expects a separate chain file or a bundled certificate file. Then reference them in the HTTPS virtual host. The essential directives are SSLCertificateFile and SSLCertificateKeyFile:
<VirtualHost *:443>
ServerName example.com
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/example.crt
SSLCertificateKeyFile /etc/apache2/ssl/example.key
DocumentRoot /var/www/example
</VirtualHost>Use the chain directive supported by your Apache and operating-system package, or point SSLCertificateFile at a correctly bundled certificate-and-chain file when that is the documented method for your build. Do not assume that a file named .crt contains the intermediate certificates.
- Check that the certificate file is readable by Apache and that the key is readable by the service at startup but not by ordinary users.
- Run Apache’s configuration test for your distribution and correct every syntax, path, and permission error before reloading.
- Reload Apache using the service manager documented by your operating system. A reload normally preserves existing connections better than a stop/start, but use the method your host supports.
- Request the public hostname and inspect the certificate actually presented on port 443. This catches a common mistake: editing a virtual host that is not the one selected for the hostname.
Nginx
In Nginx, the equivalent settings are ssl_certificate and ssl_certificate_key in the server block that listens on 443. The certificate path should normally contain the server certificate followed by the intermediate certificates in the order required by your issuer. Keep the key in a separate protected file.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsserver {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/ssl/example-fullchain.crt;
ssl_certificate_key /etc/nginx/ssl/example.key;
root /var/www/example;
index index.php index.html;
}Run Nginx’s configuration test, fix errors, reload Nginx, and then verify the certificate from the public hostname. If Nginx proxies PHP to another service, that backend does not need its own public certificate unless it is separately encrypted; it does need correct proxy and host handling.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Managed hosting or a control panel
Some hosts expose certificate management through a dashboard instead of letting you edit the web-server configuration. Upload the server certificate, private key, and intermediate certificate in the TLS or domain-security section, then bind them to the exact hostname. A successful upload is not proof that the site is using the certificate: check the public endpoint afterward, especially when the platform has separate staging and production sites or separate entries for the apex and www names.
Confirm that the key matches
A certificate and private key are a pair. If the service reports a key mismatch, stop before changing WordPress URLs. Compare the public key information derived from each file with the certificate, using the validation tools supplied by your operating system or certificate vendor. Do not “fix” a mismatch by renaming files; obtain the correct key or reissue the certificate.
Change WordPress to its canonical HTTPS URLs
When wp-admin still works
After the HTTPS virtual host responds correctly, sign in over the HTTPS address and open Settings > General. Change both fields to the same canonical origin, for example https://example.com:
- WordPress Address (URL) is the location of the WordPress core files.
- Site Address (URL) is the public address visitors use.
Include the https:// scheme and omit the trailing slash. Save once, then let WordPress sign you back in at the HTTPS address. Do not leave one field on HTTP unless you intentionally run the core files and public site at different origins and understand the consequences.
When the dashboard is inaccessible
Temporarily define the two constants in wp-config.php, before the line that says “That’s all, stop editing! Happy publishing.”:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );WP_HOME is the public address visitors type. WP_SITEURL is the location of the WordPress installation. These constants override the stored home and siteurl options while present. They do not rewrite those database values; removing the constants exposes the old values again. Once you have corrected the database through the General Settings screen or another controlled method, remove temporary constants if you want the database values to be authoritative.
Edit the file through a secure shell, hosting file manager, or deployment process. Preserve the PHP syntax and make a copy before editing. A malformed wp-config.php can prevent WordPress from loading at all.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Force secure logins and administration
After the HTTPS virtual host or proxy has been tested, add this constant to wp-config.php:
define( 'FORCE_SSL_ADMIN', true );This forces logins and administrator sessions to use HTTPS. The WordPress documentation places this setting in wp-config.php, not only in a plugin, and assumes that server-side SSL and a secure virtual host are already configured. Do not enable it as the first step on an HTTP-only or incorrectly proxied installation; it can create a redirect loop or make the login page unreachable.
FORCE_SSL_LOGIN is deprecated and should not be used for a new configuration. FORCE_SSL_ADMIN covers the administrator area and authentication flow.
Configure WordPress behind a reverse proxy
A reverse-proxy installation is the most common cause of an HTTPS redirect loop. The browser connects to the proxy over HTTPS, but the proxy forwards ordinary HTTP to Apache or PHP. Without an explicit signal, WordPress sees HTTP and tries to redirect to HTTPS; the proxy repeats the same request, producing an infinite loop.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchForward the original host and protocol
Configure the proxy to send the public host and scheme. A representative Nginx proxy location is:
location / {
proxy_pass http://wordpress_backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
}The exact upstream name and proxy syntax depend on your infrastructure. The important information is the original host and whether the client connection to the proxy used HTTPS. If the proxy substitutes an internal hostname, preserve the public hostname in Host or X-Forwarded-Host so WordPress generates correct links.
Tell WordPress when the forwarded request was HTTPS
In wp-config.php, use the documented pattern when the forwarded protocol contains HTTPS:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
&& strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
$_SERVER['HTTPS'] = 'on';
}Place this before WordPress loads its settings. Only use this logic when the request can reach the application through a proxy you control. If an untrusted client can submit X-Forwarded-Proto directly, it could spoof the value and make WordPress treat an HTTP request as secure.
Recommended Free Tools
Handle a rewritten host safely
If the proxy overwrites the host with an internal service name, set $_SERVER['HTTP_HOST'] from a validated HTTP_X_FORWARDED_HOST or an appropriate server-name value for that infrastructure. Do not blindly copy any header supplied by an Internet client. Restrict accepted proxy source addresses, normalize the allowed hostname, and reject unexpected host values at the proxy or web server.
Proxy-specific failure signs
- A loop between HTTP and HTTPS usually means the backend is not recognizing the forwarded HTTPS scheme.
- Links that contain an internal hostname indicate incorrect host forwarding or an untrusted canonical URL value.
- Secure cookies missing from the browser often mean WordPress believes the request is HTTP.
- Only some paths failing can indicate that one virtual host, location block, or origin pool has different header rules.
Test the finished HTTPS migration
Test from outside the server whenever possible. Use a private browser window for login checks so cached redirects and cookies do not hide a configuration error.
| Test | Expected result | If it fails |
|---|---|---|
| HTTPS home page | Loads at the chosen canonical hostname with a valid certificate and no browser warning. | Check hostname coverage, chain installation, virtual-host selection, and the proxy’s certificate binding. |
| An old HTTP URL | Redirects once to the matching HTTPS URL. | Inspect competing redirect rules, canonical host settings, and proxy scheme detection. |
| Representative post and attachment | Loads over HTTPS and retains its content and links. | Look for stored absolute HTTP URLs or attachment paths generated by a plugin. |
| Stylesheet, script, image, and font requests | All subresources use HTTPS and load without mixed-content warnings. | Update stored URLs and plugin settings; inspect the browser’s console for the exact insecure resource. |
| Login and wp-admin | Login form, cookies, dashboard, and logout remain on HTTPS. | Check FORCE_SSL_ADMIN, forwarded-protocol handling, and conflicting cache rules. |
| Canonical host variants | Each supported hostname reaches the one chosen HTTPS origin. | Configure a deliberate redirect for alternate names and ensure the certificate covers the name used before redirecting. |
Repair mixed content carefully
Mixed content occurs when an HTTPS page requests a resource with an absolute http:// URL. Typical sources include image fields, serialized page-builder settings, theme options, custom CSS, and plugin configuration. First make a database backup. Then use a WordPress-aware search-and-replace tool that understands serialized data, or a plugin designed for serialized values. A blind SQL replacement across every table can corrupt serialized lengths and break settings.
Search for the old origin in content and configuration, review each replacement, clear page and object caches, and retest representative pages. Update hard-coded URLs in theme files or deployment templates separately; a database replacement cannot change a URL embedded in PHP or JavaScript.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshoot common lockouts and errors
“Too many redirects”
Confirm that the browser reaches the proxy over HTTPS, that the proxy sends X-Forwarded-Proto: https, and that the backend applies the guarded $_SERVER['HTTPS'] = 'on' pattern. Check whether both the proxy and WordPress are rewriting the host or scheme in conflicting ways. Temporarily remove FORCE_SSL_ADMIN only through a controlled recovery path if it prevents access; restore it after the proxy signal is correct.
Certificate name or trust error
Verify that the public hostname is listed in the certificate, that the correct certificate is bound to the selected virtual host, and that the intermediate chain is being sent. A certificate can be valid for one name but invalid for another name that points to the same server. Confirm that DNS or the proxy is directing the hostname to the endpoint where you installed the files.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Private-key permission or startup failure
Read the service error log without exposing the key contents. Check the path, ownership, and restrictive permissions, then test the configuration again. The service account needs read access at startup; other web users do not. If the key is encrypted and the service cannot obtain its passphrase during boot, use the host’s supported secret-management method rather than weakening file permissions.
wp-admin redirects to the wrong place
Inspect the effective values of WP_HOME, WP_SITEURL, the database home and siteurl options, and any proxy host headers. Remove temporary constants only after the database contains the intended HTTPS origin. Also check for a cache containing the old redirect.
Free tools Windows power users keep installed
One-click scans. No signup required.
Layout breaks after the switch
Use the browser developer tools to identify blocked HTTP resources. Correct the source that generates each URL, clear caches, and test logged-in and logged-out views. Do not solve mixed content by disabling browser security; that hides the problem from visitors.
The site returns a gateway or upstream error
Confirm that the proxy’s upstream name, port, and health check are correct and that the backend is still listening. A certificate change should not require changing the PHP upstream. If the error began after editing the web-server configuration, restore the last known-good configuration, run its config test, and reload only after it passes.
Choose an implementation that you can operate
The right location for a custom certificate depends less on WordPress than on who controls the public TLS endpoint and how much operational access you have.
| Deployment | Certificate and key location | Operational strengths | Risks and checks |
|---|---|---|---|
| Self-managed Apache | Protected files referenced by the HTTPS virtual host. | Direct control of paths, config tests, reloads, headers, and rollback. | Wrong virtual-host selection, missing chain, permissions, and manual renewal are your responsibility. |
| Self-managed Nginx | Protected files referenced by the 443 server block. |
Clear proxy and header controls; easy to separate edge TLS from the application. | Every proxy location must preserve host and protocol consistently. |
| Managed hosting panel | Uploaded through the provider’s certificate interface. | Less server administration and often built-in renewal workflows. | Confirm that customer-supplied keys and intermediate chains are supported and that the certificate is attached to the production hostname. |
| Load balancer or CDN in front of WordPress | At the edge service; the origin may receive HTTP. | Centralized certificate rotation and traffic routing. | Forwarded headers must be restricted and validated; origin WordPress must recognize the original HTTPS scheme and public host. |
Evaluate an option by who controls the TLS terminator, whether it accepts your certificate, key, and chain, how it validates forwarded headers, whether you can run configuration tests and reloads, how you recover if URL changes lock out the dashboard, and how certificate renewal is performed.
Plan renewal, rotation, and rollback
Renew before expiry
Record the certificate’s expiration date, issuer, covered hostnames, chain requirements, and the service that will reload it. Renewal is not complete until the new certificate is installed at the actual TLS terminator and the public endpoint presents it. Test the chain and hostname after every renewal, including alternate hostnames and the login path.
Rotate without losing the working key
Keep the currently active certificate and key until the replacement has passed validation. Upload the replacement under new filenames, test the configuration, reload, and verify the public certificate. Then remove obsolete private keys according to your retention policy. Never delete the only recovery copy before confirming that the new pair works.
Prepare a rollback
Keep a known-good web-server configuration, the previous certificate and key where policy permits, a database backup, and a documented way to reach the server without the WordPress dashboard. If a URL change causes a lockout, use the recovery path to restore the previous constants or correct the database; do not repeatedly edit values through a broken redirect chain.
Security practices that matter after activation
- Restrict private-key permissions and protect backups containing the key.
- Use only the canonical HTTPS origin in WordPress settings, feeds, sitemaps, and deployment configuration.
- Trust forwarded headers only from known proxy addresses or a controlled network path.
- Keep alternate hostnames intentional. Redirect them to the canonical host only when the certificate covers the name receiving the initial request.
- Monitor certificate expiry and test renewal rather than relying on an unverified reminder.
- Review cache rules after the migration so an HTTP redirect or old HTML is not served from a stale cache.
- Keep WordPress, themes, plugins, Apache or Nginx, and the operating system patched; HTTPS does not repair vulnerable application code.
Final verification
A custom certificate installation is complete when the public hostname presents the intended certificate and chain, the HTTP origin redirects once to the chosen HTTPS origin, WordPress generates HTTPS URLs, administrator sessions remain secure, and the application correctly understands the original scheme and host when a proxy is involved. Test those conditions after the initial installation, after URL replacement, and after every certificate renewal.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
