HTTPS Encryption, Let's Encrypt, and Fixing Security Warnings

HTTPS encryption secures network traffic between a visitor's browser and the web server (protecting credentials, form submissions, and transactions), builds user trust, and improves search engine visibility (SEO).

At Seravo, every hosting plan includes a free Let's Encrypt SSL/TLS certificate by default. Our automated platform provisions and automatically renews your certificate as soon as your domain's DNS records point to Seravo's servers.

All new sites and incoming migrations on Seravo are forced over secure HTTPS connections at the server level (nginx). However, if a migrated site originally operated over unencrypted HTTP on its previous server, outdated HTTP links may still remain in the database.

Updating URLs in the Database (Search-Replace)

If you have migrated a legacy HTTP site to Seravo, ensure all internal links and media library asset paths are updated to use the secure https:// protocol.

You can easily execute this using the Seravo Plugin in the WordPress admin dashboard or via the command line. This tool also automatically updates WordPress core URL definitions (Settings > General), so running a search-replace is all that is required.

Option 1: From the WordPress Admin Dashboard

In the admin dashboard, go to Tools > Database.
In the Search for field, enter your old unencrypted URL (e.g., http://example.com).
In the Replace with field, enter your new secure URL (e.g., https://example.com).
Select All tables.
First, click Run dry-run to preview how many entries will be modified.
Once verified, click Run wp search-replace to apply the changes to the database.
Purge the site cache using the shortcut in the top admin bar.

Option 2: Via Command Line (WP-CLI)

Over an SSH connection, you can perform the entire replacement with a single command:

wp search-replace 'http://example.com' 'https://example.com' --all-tables
wp-purge-cache

(If you are running a subdirectory multisite network, this command updates all subsites simultaneously. For subdomain-based multisite installations, run the search-replace command for each domain separately).

Special Scenarios

Wildcard Certificates (*.example.com)

Let's Encrypt supports wildcard certificates that cover unlimited subdomains under a domain. Generating wildcard certificates requires verification through DNS records. If your domain does not use Seravo's nameservers and you need a wildcard certificate (for example, for a subdomain-based multisite network), please contact our customer support.

Custom Commercial SSL Certificates

The automated Let's Encrypt certificates included with Seravo plans provide the exact same modern cryptographic strength and meet all industry security benchmarks as commercial certificates. In most cases, purchasing separate commercial certificates is unnecessary, as our platform handles issuance and routine renewals automatically on your behalf.

If your organization’s internal compliance policy strictly mandates the use of a custom Extended Validation (EV) or dedicated commercial certificate:

Upload your certificate's .key and .crt/.pem files to your site's secure /data/ directory.
Contact our support team to complete the server installation.

Note: Verifying, installing, and manually renewing third-party commercial certificates in Nginx configurations is handled as billable expert work. Customers remain responsible for keeping third-party certificates valid and renewing them on time.

Cloudflare Proxy (Proxied)

If your website traffic is routed through Cloudflare's proxy network (your DNS records in Cloudflare are set to Proxied):

Why certificates do not provision automatically:
Because your domain's public DNS records resolve to Cloudflare's Anycast IP addresses rather than Seravo's servers, Seravo's automated Let's Encrypt validation cannot complete standard HTTP-01 verification requests.
Solution: DNS-Validated Certificate (CNAME Challenge)
In this case, Seravo provisions a certificate verified at the DNS level. Contact our support team, and we will provide a CNAME record (formatted like _acme-challenge.example.com) to add to your Cloudflare DNS management. This record allows Seravo to validate and renew your origin certificate automatically in the background.
Verify Cloudflare's SSL/TLS Encryption Mode:
In Cloudflare's SSL/TLS settings, always ensure the encryption mode is set to Full (Strict) or Full. Never use Flexible, as this causes an infinite redirect loop (ERR_TOO_MANY_REDIRECTS).

Troubleshooting and Exceptions

Insecure Connection Warning (Missing SSL Certificate):
Certificates can only be issued once domain DNS records point to Seravo's servers. If you have recently switched DNS, allow 10–30 minutes for propagation and certificate issuance. Also verify that both the apex domain and the www subdomain point to the same Seravo IP addresses.
Mixed Content Warning (i-icon or broken padlock in browser):
The site itself loads securely via HTTPS, but individual assets (such as images, custom web fonts, or scripts) are still being fetched via an unencrypted http:// URL.
- Open browser developer tools (F12), switch to the Console tab, and review the warnings detailing which insecure assets are being blocked.
- If the insecure links are hardcoded into your active theme, search for them over SSH:
  grep -r "http://example.com" /data/wordpress/htdocs/wp-content/themes/
  and update them to https://.
- If the asset is hosted on an external server, update the link to HTTPS or download the asset to your local WordPress Media Library.
Redirect Loops (ERR_TOO_MANY_REDIRECTS):
Seravo automatically enforces HTTPS at the nginx web server level. Deactivate outdated plugins that force SSL redirection (such as Really Simple SSL or legacy security plugins), as they attempt redundant redirects that conflict with the server configuration.
Cloudflare or External Proxy Routing:
If site traffic passes through Cloudflare, verify that the encryption mode is set to Full or Full (Strict). The "Flexible" mode causes continuous redirect loops between the proxy and Seravo.