Sort out your real domain and a working HTTPS certificate before installing the theme. Both are needed for things that come later, and fixing them afterwards costs more work than doing them first.
#A live site has to run on HTTPS
This is a requirement. The theme, the Pro plugin and the licensing all talk to our server, and every one of those requests travels over HTTPS: activation, the scheduled license check, updates, demo downloads and the integration catalog. On a plain HTTP live site they do not work reliably, and the errors you get will be about activation or the import rather than about the certificate.
The one exception is a site that is not live:
- A local install
localhost, or a domain on a reserved suffix such as.test,.localor.localhost, or a private network address. Nothing here is reachable from the internet, so a certificate would be meaningless.- A staging or development environment
A hosting provider's own staging URL, or a copy you keep for testing. These qualify for the license's free staging slot, so you can activate one without spending an activation.
HTTP is fine while the site is not a live site, and only then.
The moment it has a real domain and real visitors, it needs a certificate. The staging slot exists so you can test properly, not as a way to run a production site without one.
#The license binds to your domain
Activation ties your license to the address the site runs on. A temporary host address such as site42.hostname.com counts as a domain, so activating there and then moving to your real domain means moving the activation too.
Installing WordPress on the final domain from the start avoids the whole detour.
#Getting a certificate
Nearly every host issues a free Let's Encrypt certificate from the control panel with one switch. Issue it on the same domain the site runs on, including or excluding www consistently with how the site is addressed.
Once it is issued, check one thing in WordPress:
Open the general settings
Go to SettingsGeneral.
Check both addresses
WordPress Address and Site Address must both start with https://. If either still says http://, part of the site loads over an insecure connection and browsers warn about mixed content.
Save and reload the site
Load the front page and confirm the browser shows a secure connection with no warnings.
A missing or mismatched certificate breaks activation and downloads in a way that never mentions certificates.
License checks and demo downloads travel over HTTPS, so when the certificate is missing, expired or issued for a different domain, those requests fail while the site itself keeps loading normally. The error you see talks about activation or the import, which is why ruling this out first saves a long detour.
Outside our products, too, browsers mark a plain HTTP site as not secure, payment providers refuse to work on one, and search engines treat it as a negative signal. HTTPS is a condition for running a site at all, not an optional hardening step.
#Switching an existing site to HTTPS
Changing the two addresses does not update links already saved in your content. Images and links in older posts keep pointing at http:// URLs, which is why the mixed content warning persists after everything looks correct.
Run a search and replace across the database to update them, using a tool built for it such as Better Search Replace. Editing the database by hand is risky because WordPress stores some values in a serialized format that breaks if the text length changes without the length marker changing with it.
Take a full backup before any search and replace on a live database.
The operation touches every table, cannot be undone from the WordPress admin, and a serialization mistake is not visible until something on the site stops rendering.
#If the certificate is fine and the warning will not go away
Try two more things, in this order.
Add define('FORCE_SSL_ADMIN', true); to wp-config.php, above the line that says to stop editing. That forces the admin and the login screen onto HTTPS, which is where a mixed session causes the most trouble.
If old content is still producing mixed content warnings and you cannot run the search and replace yet, a plugin such as Really Simple SSL rewrites the offending URLs as the page is built. Treat it as a patch: the URLs in your database are still wrong, and the plugin is what stands between them and the visitor.
#Where our support ends on this
We can help with a live site, running on its own domain, over HTTPS. That is the environment the theme is built for and the only one we can see enough of to answer questions about.
Two things sit outside it:
Your staging and local environments are yours. We cannot see how your local server is configured, what its PHP build looks like, or what your virtual host is doing, so a problem that only happens there is one we can only guess about. Reproduce it on the live site and we have something to work with.
Certificate and SSL errors belong to your hosting. A certificate issued for the wrong domain, an expired one, a broken chain, a redirect loop between HTTP and HTTPS: every one of those happens below WordPress, in your hosting or your DNS, and the theme has no part in any of it. Your host is the right place for those, and they can usually fix them in minutes. The formal version of this line is in our Support Policy.
#Common questions
Do I need a paid certificate?
No. A free Let's Encrypt certificate provides the same encryption and the same browser trust as a paid one. What paid certificates sell is warranty and organizational validation, and neither affects how a WordPress site behaves.
Can I develop locally over HTTP?
Yes. A local install is not a live site, and it qualifies for the license's free staging slot, so you can activate and work normally. What you cannot do is run a public site that way and expect activation, updates and demo downloads to behave.
My host gives me a temporary address. Can I install now and move later?
You can. You will then have to deactivate the license on the temporary address and activate it on the real one, which is more work than pointing the domain first.
Should the site be at example.com or www.example.com?
Either one, as long as you pick it and use it consistently in both WordPress addresses and in the certificate. Switching later means another search and replace across the database.
The certificate is issued and the browser still warns
Check the two addresses in SettingsGeneral first, then read what the warning names.
A warning that mentions specific images or scripts is mixed content, and the search and replace fixes it. A warning about the certificate itself means it was issued for a different domain or the host has not applied it yet, and that kind is your host's to resolve.
#Still stuck
Open a support ticket and say what you tried and where it stopped. Your product, your domain, a screenshot and the exact message you saw are usually enough to settle it in one reply.
Last updated
