Really Simple SSL plugin review and common issues

A redirect loop occurs when the server redirects from HTTP to HTTPS, but WordPress generates an HTTP URL for the redirect target, creating an infinite loop. Causes and fixes: (1) the SSL certificate is not properly installed at the server level — Really Simple SSL cannot force HTTPS if the server does not have a valid SSL certificate; verify SSL in your hosting control panel; (2) a reverse proxy or CDN (Cloudflare) sits between the browser and your server — add define(“FORCE_SSL_ADMIN”, true) and add Cloudflare’s IP ranges to WordPress’s trusted proxies; (3) Really Simple SSL was deactivated without properly reverting the WordPress siteurl and home URL — directly edit wp-config.php to define WordPress URL constants as HTTPS.

Mixed content occurs when HTTPS pages load assets (images, scripts, stylesheets) from HTTP URLs. Really Simple SSL’s free version includes basic mixed content fixing by rewriting output buffer URLs from HTTP to HTTPS. For persistent mixed content: (1) use the Really Simple SSL diagnostic tool to identify the source; (2) use browser DevTools → Console to see which specific URLs are loading over HTTP; (3) common sources: hardcoded HTTP URLs in content, external scripts referencing HTTP resources, theme or plugin files with absolute HTTP paths. Run a search-replace in the database (using Better Search Replace plugin) to convert all http://yourdomain.com to https://yourdomain.com.

Access the WordPress database directly via phpMyAdmin or the hosting control panel. Find the user’s record in wp_users and note their user ID. In wp_usermeta, search for meta_key entries associated with that user ID and “two_factor” or “rsssl” — delete those meta entries to disable 2FA for that user. Alternatively, if you have another admin account, log in as that administrator and go to WordPress → Users → [affected user] → Disable 2FA in the user profile. As a preventive measure, configure backup email codes when setting up 2FA for administrators.

In Really Simple SSL Pro → Security Headers → HSTS, enable HSTS and configure the max-age value (how long browsers remember that the site requires HTTPS — recommended: 31536000 seconds = 1 year). Optionally enable “includeSubDomains” to cover all subdomains and “preload” to submit your site to the HSTS preload list (browsers then enforce HTTPS before any connection is made). Start with a short max-age (3600 = 1 hour) to test, then increase to the full year once you are confident the HTTPS configuration is stable. HSTS cannot be easily reversed once set to a long duration — plan carefully.

Let’s Encrypt certificate generation in Really Simple SSL Pro requires hosting that does not already provide SSL and supports the ACME protocol (used by Let’s Encrypt for validation). In Pro → SSL → Generate Certificate, enter your domain and email. Really Simple SSL Pro handles the domain validation challenge and certificate installation. Most modern managed WordPress hosts (Kinsta, WP Engine, SiteGround, Cloudways) already provide free SSL automatically — use Really Simple SSL’s SSL enforcement instead. The Let’s Encrypt generation is primarily useful on basic VPS or unmanaged servers without automated SSL provisioning.

Really Simple SSL (now Really Simple Security) covers SSL migration, basic hardening, 2FA, and vulnerability scanning. Wordfence adds a dedicated web application firewall (WAF), malware scanning, and real-time threat intelligence. For most small to medium WordPress sites, Really Simple Security’s free features provide a solid security baseline. If the site handles sensitive data, runs WooCommerce, or is a frequent target for attacks, adding Wordfence free (or upgrading to Really Simple Security Pro) provides additional firewall and malware protection. The two plugins can coexist.

They are the same plugin. The plugin was renamed from “Really Simple SSL” to “Really Simple Security” in 2024 to reflect its expanded scope beyond SSL migration — it now includes hardening features, 2FA, vulnerability detection, and (in Pro) a firewall. Existing installations updated automatically. The plugin’s primary URL and WordPress.org listing also updated. All functionality from the old Really Simple SSL is preserved plus the new security features.

Yes, that can happen, especially on older sites with many plugins. This usually happens when the plugin, theme, and add-ons are updated out of sequence. In most cases, testing on staging catches the issue before it reaches the live site. From experience, backups and changelog reviews save a lot of cleanup time.

Start by checking whether another plugin already does the same job. In most cases, overlap is what creates avoidable conflicts and performance issues. A common issue is installing a plugin because it looks convenient without checking the stack first. From experience, a short compatibility review avoids most of the pain later.