diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 8c0b3bfc63e1..013a1a8ba1da 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -445,6 +445,10 @@
   For those unable to upgrade yet, there is a [v0 compatibility mode](https://www.openpolicyagent.org/docs/v1.0.1/v0-compatibility/)
   available too.
 
+- Wordpress with the Caddy webserver (`services.wordpress.webserver = "caddy"`) now sets up sites with Caddy's automatic HTTPS instead of HTTP-only.
+  Given a site example.com, http://example.com now 301 redirects to https://example.com.
+  To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`.
+
 - `vscode-utils.buildVscodeExtension` now requires pname as an argument
 
 - The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix
index 827db987890e..0635b5505701 100644
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@@ -545,7 +545,7 @@ in
     services.caddy = {
       enable = true;
       virtualHosts = mapAttrs' (hostName: cfg: (
-        nameValuePair "http://${hostName}" {
+        nameValuePair hostName {
           extraConfig = ''
             root    * /${pkg hostName cfg}/share/wordpress
             file_server
diff --git a/nixos/tests/wordpress.nix b/nixos/tests/wordpress.nix
index c7988c111ac4..0983974908ed 100644
--- a/nixos/tests/wordpress.nix
+++ b/nixos/tests/wordpress.nix
@@ -75,7 +75,7 @@ rec {
               };
             };
 
-            networking.firewall.allowedTCPPorts = [ 80 ];
+            networking.firewall.allowedTCPPorts = [ 80 443 ];
             networking.hosts."127.0.0.1" = [
               "site1.local"
               "site2.local"
@@ -106,7 +106,7 @@ rec {
             machine.wait_for_unit(f"phpfpm-wordpress-{site_name}")
 
             with subtest("website returns welcome screen"):
-                assert "Welcome to the famous" in machine.succeed(f"curl -L {site_name}")
+                assert "Welcome to the famous" in machine.succeed(f"curl -k -L {site_name}")
 
             with subtest("wordpress-init went through"):
                 info = machine.get_unit_info(f"wordpress-init-{site_name}")