Website not working after SSL

Turned on HTTPS and now something looks broken? Don’t panic. When a website is not working after enabling SSL, the certificate itself is rarely the cause. It is almost always one of a few common issues. Below, we help you pinpoint which one you have and fix it step by step.

First, pinpoint the problem

Look at what the browser actually shows, because the message points straight to the cause:

• “Not secure” or a broken padlock → mixed content.
• “redirected too many times” / ERR_TOO_MANY_REDIRECTS → a redirect loop.
• A certificate name warning → the certificate does not cover the exact address you opened.
• Old pages or styling missing → cached content or hard-coded HTTP links.

Mixed content: the “Not secure” warning

This is the most common issue. Your page loads over HTTPS, but some images, scripts, or stylesheets still load over http://, so the browser flags the page as only partly secure. To find the culprits, open the page, press F12, and read the console warnings – each insecure file is listed by URL.

To fix it, switch those links to https://. In WordPress, first set both WordPress Address and Site Address to https:// under Settings → General. A plugin such as Really Simple SSL then rewrites the remaining links for you. If a specific image or font is still insecure, check your theme or page-builder settings for a hard-coded http:// link.

Too many redirects (ERR_TOO_MANY_REDIRECTS)

A redirect loop means two rules are sending the browser back and forth. There are three usual causes:

• Duplicate redirects – one in your app and one in .htaccess. Keep only a single HTTP-to-HTTPS rule.
• Cloudflare set to “Flexible” SSL – this is the most common trigger. In Cloudflare, set SSL/TLS mode to Full so it stops looping with your server.
• A URL mismatch – your site address and the address you are visiting don’t match (for example www vs non-www).

A clean redirect in your .htaccess file looks like this:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Certificate name warnings

If the browser warns that the certificate does not match the site, you are usually opening a name the certificate does not cover – often www when only the bare domain is secured, or vice versa. In cPanel, open SSL/TLS Status, tick both the domain and its www version, and click Run AutoSSL so both are included.

Old links and cached pages

Sometimes your content still points to the old http:// address. A search-and-replace tool that swaps http://yourdomain.com for https://yourdomain.com across the database will fix this in one pass. Finally, clear your caching plugin and your browser cache, then reload with https:// – that is often the last step before the padlock shows everywhere.

Need more help?

Still seeing errors after trying the fixes above? Open a ticket through Client Area → Support Tickets with your domain and a screenshot of the error, and our team will check your SSL and redirects. For the basics, see our guide on free Let’s Encrypt SSL in cPanel.