Two boxes on Settings → General look harmless: WordPress Address (URL) and Site Address (URL). Most owners only notice them when something prompts a change. The site has just got an SSL certificate and should use https. Someone wants the www dropped. A new domain has been bought.
These are also the two fields most likely to lock you out of your own site with a single click of Save. If you are reading this after that click, skip to the section on getting back in. Otherwise, it is worth knowing what the WordPress Address and Site Address each control, and how to change the site URL without losing access, before you touch either one.
What the two fields mean
The WordPress Address tells WordPress where its own files live: the admin area, the login page, the core scripts. The Site Address is the address visitors type to reach your home page, and the base WordPress uses when it builds links to your pages.
On most business sites the two are identical, for example both set to https://www.example.com. They differ only when WordPress was installed in a subfolder but the site is meant to appear at the root. In that setup the WordPress Address ends in the folder name and the Site Address does not. If yours differ and you did not set it up that way on purpose, ask whoever built the site before you touch either.
Both values are stored in the database. When you save the form, WordPress immediately starts using the new values for every link and redirect it generates, including the redirect to the login page. That is why a typo is so unforgiving: WordPress sends you to the address you gave it, and if that address does not work, neither does the dashboard.
Check these before changing the site URL
- The new address already works. For a move to https, the SSL certificate must be installed and the https version must load in your browser first. If that part is not done yet, start with getting an SSL certificate installed. For www versus no-www, both versions should already reach the same hosting.
- You can reach your files. Make sure you can log in to your hosting control panel and open its file manager, or connect by FTP. That is your way back if the dashboard stops responding.
- You have a fresh backup. A backup taken just before the change gives you a clean way back if something unexpected breaks.
- You know whether the fields are editable. If they are greyed out, see the section on wp-config.php below.
Settings → General holds several other basic settings, such as the title, time zone and admin email. Our walk through the WordPress admin screens explains where each one is covered.
Changing the WordPress Address and Site Address safely
For the usual case, moving from http to https or settling on www or non-www on the same hosting, the change looks like this:
- Go to Settings → General.
- Edit WordPress Address (URL) and Site Address (URL) to the new form, for example from http://example.com to https://example.com. Type the full address including https://, with no slash at the end.
- Read both fields twice. A missing letter, a stray space or “htps” is all it takes.
- Click Save Changes.
- WordPress will usually ask you to log in again, because your login cookie belonged to the old address. Log in at the new address.
- Open the front of the site in a private window and click through a few pages, the contact form and the menu.
Two follow-up jobs usually remain after an https switch. Images and links inside your content may still point to http, which causes “not fully secure” warnings; our post on mixed content warnings after moving to HTTPS explains how to find and fix them. And visitors arriving at the old http address should be redirected to the new one, which is normally done at the hosting level or with a redirect rule rather than in WordPress settings.
When the fields are greyed out
If you cannot click into either box, the values are being set in the site’s wp-config.php file, using two lines called WP_HOME and WP_SITEURL. Whatever is written there overrides the database, so the dashboard shows the fields but will not let you edit them.
This is often deliberate. Developers and some hosts set them to stop exactly the kind of accidental change this post warns about. If the values there are correct, leave them alone. If they need changing, edit them in wp-config.php itself, carefully, after downloading a copy of the file.
Locked out after a change: getting back in
The symptoms vary. The site may not load at all, the browser may show a security warning, the login page may keep reloading, or every page may redirect to an address that does not exist. Do not keep saving and retrying. Use one of these routes instead.
Route 1: set the correct address in wp-config.php
- Open your hosting file manager and find wp-config.php in the folder that holds WordPress (often public_html or httpdocs).
- Download a copy before editing, so you can restore it if something goes wrong.
- Edit the file and, above the line that says “That’s all, stop editing!”, add two lines with your correct address:
define( ‘WP_HOME’, ‘https://www.yourbusiness.com’ );
define( ‘WP_SITEURL’, ‘https://www.yourbusiness.com’ ); - Save the file and load the site again. The values in the file take priority over the broken ones in the database.
- Log in, go to Settings → General, and decide whether to keep the lines (the fields will now be greyed out) or remove them after fixing the database values.
Route 2: correct the values in the database
Most hosting panels include phpMyAdmin. Open the site’s database, then the options table. It is usually called wp_options, though the prefix may be different on your site. Find the rows named siteurl and home, near the top, and edit their values to the correct address. This route is precise but unforgiving, so take a database backup first and edit nothing else.
Route 3: your host’s WordPress tool
Many hosting panels have a WordPress management tool that shows the site’s URL and lets you change it. If yours does, it is the gentlest option. Your host’s support team can also tell you which approach their setup expects.
If the login page keeps bouncing you back even after the addresses are right, the cause may be cookies or a plugin rather than the URL; see why the WordPress login page keeps reloading.
What these fields will not do for you
Changing the two addresses is not the same as moving a site. It does not copy files, does not rewrite the old address stored inside your posts, image links and page builder data, and does not redirect old links. Moving to a new domain or a new host involves all of those steps, plus updating Search Console and your Google business profile. That is a migration, and it is worth planning as one; our WordPress migration service page describes what the job involves.
For the many other jobs a site owner looks after, our WordPress guide for business owners gathers them in one place.
Frequently asked questions
Should my WordPress Address and Site Address include www?
Either is fine. What matters is choosing one form and using it everywhere, with the other version redirecting to it. If your site has always used www, keep it, because changing it creates work with redirects and search listings for no real benefit. Set both fields to match the version your visitors and Google already use.
Do I need to change these fields when I renew my SSL certificate?
No. A renewal keeps the same https address, so nothing in WordPress needs to change. You only edit these fields once, when the site first moves from http to https. If the site starts showing security warnings after a renewal, the certificate itself has a problem, which is a hosting matter.
Will changing the site URL affect my Google rankings?
A switch from http to https on the same domain, done with proper redirects, is a normal change that search engines handle routinely. Changing to a different domain is a bigger move that needs redirects from every old page and notice in Search Console, and some disruption is possible while Google processes it.
Is it safe to leave WP_HOME and WP_SITEURL in wp-config.php permanently?
Yes, many sites do. It stops anyone from changing the addresses by accident in the dashboard. The only drawback is that future changes must be made in the file, so note it somewhere for whoever looks after the site next, or they may wonder why the fields are greyed out.
A mistyped site address is one of the more common reasons an owner suddenly loses the dashboard, and the fix is a matter of reaching the files or the database rather than anything in WordPress itself. If you would rather not edit wp-config.php or phpMyAdmin yourself, our WordPress bug fixing service handles this kind of lockout, from ₹1,499 per incident onwards.
Next in this series: WordPress Admin Bar: What It Shows and How to Hide It
