Enable HTTPS and SSL in Joomla

Affiliate disclosure: this post may contain affiliate links (e.g., MonsterONE, Envato). If you buy through them, we may earn a commission at no extra cost to you.

🖼️ [SCREENSHOT NEEDED] Hero image: a browser address bar showing a secure padlock icon next to an https:// Joomla site URL.

This guide covers enabling HTTPS and SSL on Joomla 5.x and 6.x, the two currently supported series as of mid-2026 (verified against Joomla 5.4.7 and 6.1.2). If you're still on Joomla 3.x or 4.x, the Global Configuration steps are effectively the same, but some server-level details (PHP version, .htaccess behavior) may differ — check your host's documentation if anything doesn't match.

📋 What You'll Need

Requirement	Why you need it
Admin access to your hosting control panel (cPanel, Plesk, or similar)	To issue and activate the SSL certificate
Joomla Super User (admin) login	To change Global Configuration settings
FTP/SFTP or File Manager access (optional)	Only needed if you must edit .htaccess manually
A domain pointed correctly to your hosting (DNS already propagated)	Certificate issuance will fail otherwise

Step 1 — Check Whether You Already Have an SSL Certificate

Before touching anything in Joomla, open https://yourdomain.com directly in a browser. If it loads with a padlock and no warning, you already have a working certificate — skip ahead to Step 4. If it fails to load, shows "Not Secure," or throws a certificate error, continue to Step 2.

Step 2 — Install a Free SSL Certificate via Your Host

Almost every host today issues free Let's Encrypt certificates directly from the control panel:

• cPanel: go to "SSL/TLS Status" and run AutoSSL for your domain.
• Plesk: open the domain, click "SSL/TLS Certificates" → "SSL It!" (Let's Encrypt).
• Managed WordPress/Joomla hosts (e.g., Cloudways, SiteGround, Hostinger): usually a one-click "Enable HTTPS" or "Enable SSL" toggle in the site dashboard.

Issuance is normally instant to a few minutes. If you bought a paid certificate separately, ask your host to install it for you — this part happens outside Joomla entirely.

🖼️ [SCREENSHOT NEEDED] cPanel "SSL/TLS Status" page with AutoSSL running/complete for the target domain, status column visible.

Step 3 — Verify the Certificate Is Live

Reload https://yourdomain.com in a private/incognito window. You should see the padlock with no warnings. If you want a deeper check, run the domain through SSL Labs' SSL Test — it flags weak configurations, expired chains, or missing intermediate certificates before you force HTTPS site-wide.

Step 4 — Turn On Force HTTPS in Joomla Global Configuration

Once the certificate is confirmed working:

1. Log in to the Joomla administrator panel.
2. Go to System → Global Configuration.
3. Open the Server tab.
4. Find the Force HTTPS setting. There are three options: None, Administrator Only, and Entire Site.
5. Select Entire Site.
6. Click Save & Close.

Administrator Only secures just the backend login (/administrator) while leaving the public-facing site on HTTP — useful only as a temporary halfway step, not a real fix, since visitor traffic and forms on the front end stay unencrypted.

🖼️ [SCREENSHOT NEEDED] Joomla admin, System → Global Configuration → Server tab, with the Force HTTPS field circled in red and "Entire Site" selected.

Step 5 — Update the Live Site URL and Check the Site Tab

Go to System → Global Configuration → Site tab and confirm the Site Name and any hardcoded URL fields don't reference http://. In most modern Joomla versions the "Live Site URL" field can stay blank (Joomla auto-detects the domain), but if your setup has it filled in manually, make sure it starts with https://.

Step 6 — Fix Mixed Content Warnings

After forcing HTTPS, some pages may still show a broken or "not fully secure" padlock. This is mixed content: the page itself loads over HTTPS, but it's still pulling an image, script, or stylesheet from an http:// address.

1. Open the page in Chrome or Firefox, press F12, and check the Console tab for "Mixed Content" warnings — they list the exact insecure resource URL.
2. Search your template overrides, custom modules, and article content for hardcoded http://yourdomain.com/... links.
3. Replace them with https://, or better, use protocol-relative/relative paths where your template supports it.
4. Clear Joomla's cache (System → Clear Cache) and your host/CDN cache afterward.

📊 [SCREENSHOT NEEDED] Browser DevTools Console tab open on a Joomla page, showing a "Mixed Content" warning line with the insecure resource URL visible.

Step 7 — Special Case: Using Cloudflare or Another CDN/Proxy

If your domain sits behind Cloudflare (or a similar proxy), the most common failure after this setup is an infinite redirect loop (ERR_TOO_MANY_REDIRECTS). This happens when Cloudflare's SSL/TLS mode is set to Flexible: Cloudflare talks to your visitor over HTTPS but connects to your Joomla server over plain HTTP. Your server then redirects that HTTP request back to HTTPS, Cloudflare downgrades it to HTTP again — and it loops forever.

Fix: in the Cloudflare dashboard, go to SSL/TLS and change the mode from Flexible to Full or, ideally, Full (Strict). This requires a valid certificate on your origin server (the one you installed in Step 2), so Cloudflare and your host both talk HTTPS end to end.

Symptom	Likely cause	Fix
ERR_TOO_MANY_REDIRECTS site-wide	Cloudflare SSL mode set to Flexible	Switch to Full or Full (Strict) in Cloudflare
Some images/scripts 403 or missing only over HTTPS	Origin can't serve HTTPS but Force HTTPS is on, combined with Flexible mode	Fix origin certificate first, then set Cloudflare to Full
Loop happens only after login	Session cookie set with wrong scheme	Clear cookies; confirm Force HTTPS + Cloudflare mode match

Step 8 — Verify Everything Works End to End

• Visit the site in a private window from both http:// and https:// — both should land on the final https:// URL.
• Check the admin login page redirects to HTTPS as well.
• Run the domain through SSL Labs again for a final grade.
• Add/verify the https:// property in Google Search Console and resubmit your sitemap so Google recrawls the secure URLs.

🧯 Common Mistakes to Avoid

• Forcing HTTPS before the certificate actually works. This is the #1 cause of a full site lockout — always confirm the padlock loads cleanly first (Step 3).
• Leaving Cloudflare on Flexible SSL while Force HTTPS is on in Joomla. This is the classic setup for an infinite redirect loop (Step 7).
• Ignoring mixed content warnings. The site "works" but shows a broken padlock, which still triggers browser warnings for visitors.
• Forgetting to update Search Console / sitemap after the switch. Google can keep indexing the old HTTP URLs longer than necessary.
• Mixing uppercase and lowercase in hardcoded file paths. On some strict server configurations this causes inconsistent 403 errors only under HTTPS.

❓ FAQ

Do I need to buy an SSL certificate to use HTTPS on Joomla?

No. Most hosts now issue free Let's Encrypt certificates through cPanel (AutoSSL) or Plesk ("SSL It!"). A paid certificate is only needed for specific business/compliance requirements, not for basic HTTPS.

What's the difference between "Administrator Only" and "Entire Site" in Force HTTPS?

Administrator Only encrypts just the /administrator login area. Entire Site encrypts every page visitors see. For a public website, Entire Site is the setting you want.

Why do I get "too many redirects" right after enabling Force HTTPS?

This almost always means a CDN/proxy like Cloudflare is set to Flexible SSL while Joomla is also forcing HTTPS. Switch Cloudflare's SSL mode to Full or Full (Strict) — see Step 7.

Will switching to HTTPS hurt my Google rankings?

No — HTTPS has been a confirmed ranking signal for years, and a correctly configured 301 redirect from HTTP to HTTPS preserves existing SEO value. Just remember to update Search Console afterward.

How do I fix a padlock that shows "not fully secure"?

That's mixed content — some resource on the page is still loading over http://. Open DevTools → Console to find the exact URL and update it to https:// (Step 6).

Does Joomla let me force HTTPS on only specific pages?

Not natively — Global Configuration only offers None, Administrator Only, or Entire Site. Per-page HTTPS rules require a third-party extension or custom .htaccess rules.

➡️ What's Next

[CẦN BẠN XÁC NHẬN: thêm link tới các bài liên quan trên blog, ví dụ hướng dẫn cấu hình Cloudflare cho Joomla, hoặc bài về security hardening với Admin Tools Pro, nếu đã có sẵn]