Once a certificate is issued, all traffic should be forced to HTTPS so nobody lands on the insecure version.
THE SIMPLEST METHOD
cPanel > Domains, find the domain, and switch Force HTTPS Redirect on. Done.
THE .HTACCESS METHOD
Add this to the top of public_html/.htaccess, above any application block:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]USE ONE METHOD ONLY
The most common cause of "too many redirects" is having the cPanel toggle on, a rule in .htaccess, and a "force SSL" option enabled in a plugin, all at once. Pick one.
ALSO UPDATE THE APPLICATION
In WordPress, set both WordPress Address and Site Address in Settings > General to https://. Other applications have an equivalent setting. If this is left on http://, the application generates insecure links and fights your redirect.
IF YOU USE CLOUDFLARE
SSL/TLS mode must be Full (strict). Flexible mode tells Cloudflare to reach us over HTTP while serving HTTPS, and our redirect sends it straight back, producing a loop.
Test in a private browsing window, since browsers cache redirects aggressively.
