A shop without HTTPS will lose customers and may be refused by payment gateways.
ISSUING THE CERTIFICATE
cPanel > SSL/TLS Status, tick the domain, run AutoSSL. Free, automatic, and renews itself.
FORCING HTTPS
cPanel > Domains > Force HTTPS Redirect. Then set both WordPress Address and Site Address to the https:// form under Settings > General.
Use one redirect method only. The cPanel toggle plus an .htaccess rule plus a plugin option produces a redirect loop.
THE WHOLE SITE, NOT JUST CHECKOUT
Browsers flag any page collecting input over HTTP. Partial HTTPS also breaks sessions between cart and checkout.
AFTER ENABLING
Fix mixed content: images and scripts still requested over HTTP break the padlock. Use Better Search Replace across the database, replacing http://yourdomain.com with the https form, after taking a backup.
BEYOND THE CERTIFICATE
Two-factor authentication on every administrator account Keep WooCommerce, WordPress, the theme and every extension updated Never store card numbers anywhere on the account Use a hosted gateway so card details are entered on their infrastructure
