Sort out your real domain and a working HTTPS certificate before installing the theme. Both are needed for things that come later, and fixing them afterwards costs more work than doing them first.
#The license binds to your domain
Activation ties your license to the address the site runs on. A temporary host address such as site42.hostname.com counts as a domain, so activating there and then moving to your real domain means moving the activation too.
Installing WordPress on the final domain from the start avoids the whole detour.
#Getting a certificate
Nearly every host issues a free Let's Encrypt certificate from the control panel with one switch. Issue it on the same domain the site runs on, including or excluding www consistently with how the site is addressed.
Once it is issued, check one thing in WordPress:
Open the general settings
Go to SettingsGeneral.
Check both addresses
WordPress Address and Site Address must both start with https://. If either still says http://, part of the site loads over an insecure connection and browsers warn about mixed content.
Save and reload the site
Load the front page and confirm the browser shows a secure connection with no warnings.
#Why HTTPS is not optional here
A missing or mismatched certificate breaks activation and downloads in a way that never mentions certificates.
License checks and demo downloads travel over HTTPS, so when the certificate is missing, expired or issued for a different domain, those requests fail while the site itself keeps loading normally. The error you see talks about activation or the import, which is why ruling this out first saves a long detour.
Beyond us: browsers mark a plain HTTP site as not secure, payment providers refuse to work on one, and search engines treat it as a negative signal. In 2026 it is a condition for running a site at all rather than a hardening step.
#Switching an existing site to HTTPS
Changing the two addresses does not update links already saved in your content. Images and links in older posts keep pointing at http:// URLs, which is what causes the mixed content warning to persist after everything looks correct.
Run a search and replace across the database to update them, using a tool built for it such as Better Search Replace. Editing the database by hand is risky because WordPress stores some values in a serialized format that breaks if the text length changes without the length marker changing with it.
Take a full backup before any search and replace on a live database.
The operation touches every table, cannot be undone from the WordPress admin, and a serialization mistake is not visible until something on the site stops rendering.
#Common questions
Do I need a paid certificate?
No, a free Let's Encrypt certificate provides the same encryption and the same browser trust as a paid one, since what paid certificates sell is warranty and organisational validation, neither of which affects how a WordPress site behaves.
My host gives me a temporary address. Can I install now and move later?
You can, and you will then have to deactivate the licence on the temporary address and activate it on the real one, which is more work than pointing the domain first.
Should the site be at example.com or www.example.com?
Either one, as long as you pick it and use it consistently in both WordPress addresses and in the certificate, because switching later means another search and replace across the database.
The certificate is issued and the browser still warns
Check the two addresses in SettingsGeneral first, then read what the warning actually names: a padlock warning that mentions specific images or scripts is mixed content and the search and replace fixes it, while a warning about the certificate itself means it was issued for a different domain or the host has not applied it yet.
#Still stuck
Open a support ticket with your domain and the exact browser warning.
Last updated
