Setting Up Drupal to Use SSL¶

Use this page for setting up drupal to use ssl. Confirm the certificate is available first, then update the application or DNS settings that control HTTPS behavior.

Before You Start¶

• Open https://example.com in a browser and confirm the SSL certificate loads without a browser warning.
• Make a backup of the site files before editing settings.php or .htaccess.
• Keep access to cPanel File Manager, SSH, SFTP, or another file editor.

Option 1: Use cPanel Force HTTPS Redirect¶

Start here before editing Drupal files directly.

1. Sign in to the Fused client area.
2. Select Services.
3. Select the green Active status next to the relevant hosting account.
4. Select Login to cPanel.
5. Open Domains.
6. Turn on Force HTTPS Redirect for the Drupal domain.
7. Visit http://example.com and confirm it redirects to https://example.com.

Option 2: Use Drupal Admin¶

Drupal core does not provide the same universal SSL switch in every version. Some sites expose HTTPS controls through installed modules, distribution settings, or hosting integration.

1. Sign in to Drupal over HTTPS at https://example.com/user/login.
2. Go to Configuration.
3. Check for SSL, HTTPS, redirect, base URL, or security settings added by installed modules.
4. If a setting exists to force HTTPS, enable it and save the configuration.
5. Clear Drupal's caches from the admin interface.
6. Test the public site and admin area in a private browser window.

Option 3: Edit Drupal Files¶

Use this path when cPanel and the admin interfaces do not expose the setting you need.

Drupal 7¶

1. Open sites/default/settings.php.
2. Look for a $base_url setting.
3. If $base_url is set to an http:// address, update it to https://.

$base_url = 'https://example.com';

1. Save the file.
2. Clear Drupal's caches.
3. Visit the site over https:// and click through a few pages to confirm links, images, and stylesheets load correctly.

Drupal 8, 9, and 10¶

Drupal 8 and newer usually detect the current request scheme, so most sites do not need a base URL setting changed in settings.php.

1. Confirm https://example.com loads correctly.
2. Add a server-level redirect from HTTP to HTTPS.
3. Clear Drupal's caches.
4. Test the public site and the Drupal admin area.

Force HTTP to HTTPS¶

If the site still loads over plain HTTP, add or confirm an HTTPS redirect. On many Drupal sites this can be done in the site's .htaccess file.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Place custom redirect rules carefully so they do not conflict with Drupal's existing rewrite rules.

Check for Mixed Content¶

After the site loads over HTTPS, check for images, scripts, stylesheets, or embeds still using http://.

• Update hardcoded internal links to use https://.
• Update theme or module settings that store full URLs.
• Check custom blocks, menus, and templates.
• Clear Drupal caches again after changes.

What to Check¶

• https://example.com loads without a certificate warning.
• http://example.com redirects to https://example.com.
• The Drupal admin area works over HTTPS.
• Images, CSS, JavaScript, and embedded assets load without mixed-content warnings.
• Forms and checkout pages still submit correctly.