Force every WooCommerce checkout URL to HTTPS before a customer enters payment details, and use WP Force SSL to handle the redirect cleanly across your WordPress store. This matters because Baymard reports an average cart abandonment rate of about 70%, so even small checkout friction can cost real revenue [source: Baymard Institute].
TLDR: Install WP Force SSL, enable SSL forcing, and make sure your WooCommerce checkout and cart pages always load with https://. For example, if a customer lands on http://example.com/checkout/, they should be sent to https://example.com/checkout/ before seeing the payment form. A store with 10,000 monthly checkout visits could lose hundreds of orders if browser warnings appear for even 3% of visitors. Test the checkout after setup using a real product, a test payment method, and both desktop and mobile browsers.
Why WooCommerce Checkout Must Always Use HTTPS
WooCommerce checkout pages collect names, emails, addresses, payment choices, and sometimes account passwords. That data must move through an encrypted connection. If it does not, browsers may show warnings, payment gateways may fail, and customers may leave.
Honestly, it feels like one plain http link can ruin a checkout you spent weeks building. A menu link, an old email campaign, or a cached page can send shoppers to the wrong version of the URL. WP Force SSL helps stop that by forcing secure loading across the site.
Use WP Force SSL to Fix the Problem
WP Force SSL is built for a clear job: send visitors from HTTP to HTTPS and help detect SSL problems. For WooCommerce, that means customers should see the secure padlock before they enter sensitive details.
Follow this process:
- Confirm your SSL certificate is active. Your host usually provides this through Let’s Encrypt or a paid certificate.
- Install WP Force SSL from your WordPress dashboard.
- Activate the plugin and open its settings panel.
- Enable Force SSL so HTTP pages redirect to HTTPS.
- Check WooCommerce pages, especially cart, checkout, account, and payment return pages.
- Clear cache from your caching plugin, hosting panel, and CDN if you use one.
The main goal is simple: every version of the checkout page should end at the secure HTTPS URL. That includes links from emails, ads, coupons, old blog posts, and bookmarks.
Check Your WordPress and WooCommerce URLs
After enabling the plugin, check your core WordPress URLs. Go to Settings > General in the WordPress admin area. The WordPress Address and Site Address should both start with https://.
Then check WooCommerce page settings:
- Cart page: should load over HTTPS.
- Checkout page: must load over HTTPS every time.
- My Account page: should be secure because it may show order and address data.
- Payment gateway return URLs: should not drop back to HTTP after payment.
It drives me crazy that some stores fix the main checkout URL but forget the account page or order received page. Customers notice that. Payment providers notice it too.
Test the Redirect Like a Customer
Do not stop after clicking the homepage. Test the full buying path. Use a private browser window so cached sessions do not hide problems.
Test these URLs manually:
- http://yourstore.com/checkout/
- http://www.yourstore.com/checkout/
- https://yourstore.com/checkout/
- https://www.yourstore.com/checkout/
Each version should land on the correct HTTPS checkout page. If one version fails, you may have a mismatch between WordPress settings, hosting redirects, CDN settings, or your preferred domain.
Watch for Mixed Content Errors
HTTPS may be active, but the browser can still complain if images, scripts, fonts, or stylesheets load over HTTP. This is called mixed content. It can break the padlock icon and make the page look unsafe.
WP Force SSL can help identify common SSL issues, but you should still inspect the checkout page. Open the page in Chrome, right click, choose Inspect, and check the Console tab. Look for lines that mention mixed content.
Common causes include:
- Old image URLs in product descriptions.
- Hardcoded HTTP links in themes.
- Outdated page builder content.
- Third party scripts loaded from insecure URLs.
Do Not Rely Only on WooCommerce Settings
Older WooCommerce versions had settings related to forcing secure checkout. Modern stores should handle HTTPS at the site level. That is cleaner and safer. A checkout only rule may miss account pages, AJAX calls, assets, or payment callbacks.
WP Force SSL gives you a wider fix. It helps push the whole WordPress site to HTTPS, not just one page. That matters when customers move between product pages, cart, checkout, order payment, and account screens.
Final Checklist Before You Go Live
- SSL certificate: active and valid.
- WP Force SSL: installed and forcing HTTPS.
- WordPress URLs: both set to HTTPS.
- WooCommerce checkout: redirects from HTTP to HTTPS.
- Mixed content: checked and fixed.
- Cache: cleared after changes.
- Payment test: completed from cart to thank you page.
A secure checkout is not a nice extra. It is basic store hygiene. Set up WP Force SSL, test the full order path, and remove every insecure checkout route before customers find it for you.