In our previous article, "Can You Really Go Without Encryption? A Summary of Free SSL for Your Website," we explained why SSL is essential.

Going SSL boosts the trust of prospective customers, can improve your search rankings, and above all it's free—so there's really no reason not to make the switch, right?

So this time, we'll walk you through the whole process, from obtaining an SSL certificate to implementing it on a website that's already up and running.

Note that this article assumes the following environment.
Server: XServer
Platform: WordPress

1: Obtain a free SSL certificate on XServer

1-1. Unlike paid SSL, free SSL is obtained from the Server Panel

On XServer, a dedicated SSL certificate is normally obtained via "Info Panel" → "Contract-related: Additional Application" → "Optional Dedicated SSL: New Application," but the procedure differs when obtaining the free SSL introduced here—you get it from the "Server Panel."

1-2. Obtain SSL from the Server Panel

Log in to the "Server Panel" and click SSL Settings.

1-3. Add a dedicated SSL setting

Click the "Add Dedicated SSL Setting" tab, then click "Add dedicated SSL setting (confirm)."
*If you want the SSL certificate information to be in your own company's name, check "CSR information (SSL certificate application information)" and enter your company details in the input form.

1-4. Dedicated SSL setup complete

That's it—setup is done! It's so easy it's almost anticlimactic (lol). Now just wait a while for the SSL to actually take effect.
*When obtaining a new SSL certificate, the settings are usually applied within a few minutes to a few dozen minutes, but if you are transferring servers (changing name servers) at the same time or already have an SSL contract, it may take several hours or more to take effect.

*If you check the page in your browser before the settings take effect, you'll see a page with the message "Invalid URL." Once the settings are applied, the page will display automatically. Just be patient until then.

2: Configure the WordPress side

Once the dedicated SSL is set up, continue with the settings on the WordPress side.

2-1. Change the WordPress site URL from "http:" to "https:"

① In WordPress, log in to the Dashboard → click "Settings" → "General" to display the General Settings screen.
② Change both the "WordPress Address" and "Site Address" URLs to "https:", then scroll to the bottom of the screen and click "Save."

2-2. Check the image reference URLs and change them to https

If the reference URLs of the images used on your site remain as http, the page may not be recognized as fully encrypted.

When you view the page in Google Chrome, instead of "Secure https://…" you'll see "! https://…".
In this state, Google most likely recognizes the page as literally "not secure," and it probably won't be evaluated favorably for SEO either. If your site is in this state, be sure to fix it so that it shows "Secure."

3: Use .htaccess to automatically redirect "non-SSL pages" to "SSL pages"

If you're doing "register a new domain → set up dedicated SSL → build a new website," the steps up to this point are enough.
However, if you've switched an existing website to SSL, it may be worth putting in a little extra effort for SEO.
That's because by following [2-1. Change the WordPress site URL from "http:" to "https:"], the top page will automatically redirect to the SSL page.
All links within the site will also be converted to "https://…", so lower-level pages will naturally lead to SSL-enabled pages as well.

However, lower-level pages already indexed by Google as "http://… (non-SSL)" will continue to be displayed in their non-SSL state.
There is a time lag of several days to several weeks before Google's crawler re-indexes every page on your site from the existing http (non-SSL) versions to the https (SSL) versions.
So, if you automatically redirect visitors to the SSL URL when they land on a non-SSL page, the pages are likely to be indexed sooner, and you may see SEO benefits more quickly.

Here, we'll show you how to configure .htaccess to redirect every non-SSL page within your domain to its SSL page.
*Be aware that a mistake in your .htaccess settings can make your site fail to display. Configure it carefully and at your own risk.

3-1. Edit .htaccess to set up automatic redirection to SSL pages

Here we'll proceed on the assumption that you're configuring this from the XServer Server Panel.
① Click "Server Panel" → ".htaccess Edit" to display the .htaccess editing screen.
② Enter the following code in .htaccess.

##Automatic redirect to SSL###
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
###—————###

4: Register the SSL-enabled site anew in Google Search Console

As mentioned earlier, the sooner your SSL-enabled pages (here, the entire website) are indexed by Google, the more likely you are to see SEO benefits.
That being the case, it's a good idea to register the site anew in Google Search Console using the "https" URL.

・Add the site anew using the https://… URL
・Upload the sitemap
・(If necessary) Use Fetch as Google to call the crawler

Once you've done these, the whole setup is complete.
You only need to go through this series of steps once, so do give it a try!