Forcing the redirect to HTTPS

• cPanel › Domains › Domains: turn on Force HTTPS Redirect for the domain.
• Or add to .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

For WordPress, also check that the site address starts with https:// (Settings › General).