Turn on free SSL and force HTTPS on web hosting
Secure every site on your hosting account with the free certificate: check AutoSSL in cPanel or SSL It! in Plesk, redirect HTTP to HTTPS and fix mixed content.
- Beginner
- 10 min read
- Updated
On this page
Every web hosting plan includes a free SSL certificate. Once your domain points to the hosting account, the panel issues it and renews it. This guide checks the certificate, sends all visitors to HTTPS and fixes the most common warning, mixed content, in cPanel and Plesk.
Before you start
- Your domain (and
www) points to the hosting account: either through the hosting nameservers or an A record to the server's IP address; see point a domain to your server. Certificates can only be issued after that. - Your control panel login: log in to your control panel.
Step 1: Check that the certificate is issued
cPanel
Open SSL/TLS Status. It lists your domains with their certificate. Domains secured by the free certificate show an AutoSSL DV Certificate; domains that could not be secured are marked Has AutoSSL Problems, with the reason.
Plesk
Open Websites & Domains and the domain's SSL/TLS Certificates (the SSL It! extension). Choose to install the free certificate, include the www name, and confirm.
Verify: https://example.com and https://www.example.com open with a padlock in the browser.
Step 2: Send everyone to HTTPS
cPanel
Open Domains and turn on Force HTTPS Redirect for the domain. The switch is available once the domain has a valid certificate.
Plesk
Open the domain's Hosting Settings and tick Permanent SEO-safe 301 redirect from HTTP to HTTPS, then select OK.
Verify: typing http://example.com in the browser ends at https://example.com.
Step 3: Update your site's own address
Applications store their address. Change it to https://:
- WordPress: Settings › General, set WordPress Address (URL) and Site Address (URL) to
https://example.com. - Other applications: look for a "base URL" or "site URL" setting in their configuration.
Step 4: Fix mixed content
When an HTTPS page loads images, scripts or styles over http://, browsers block some of them or remove the padlock. Open the browser's developer tools (F12), look at the Console for "mixed content" messages and change the listed addresses to https://. In WordPress, links stored in posts may need a search-and-replace of http://example.com with https://example.com (back up the database first).
Troubleshooting
cPanel shows "Has AutoSSL Problems" for www or the domain. That name does not point to the hosting server, or a DNS record (for example a CAA record) prevents issuance. Fix DNS and wait for the next AutoSSL run.
Plesk cannot issue the certificate. The domain or www does not point to the server yet, or the site blocks the validation check. Check DNS and try again.
ERR_TOO_MANY_REDIRECTS after turning on the redirect. The site redirects twice, for example through the panel and through a plugin or a proxy such as Cloudflare. Keep one redirect; with Cloudflare, use Full (strict) SSL mode; see Cloudflare proxy setup.
Certificate errors in the browser. See fix SSL certificate errors.
Next steps
- Paid certificates with organisation validation: order, validate and install an SSL certificate.
- Certificate problems: fix SSL certificate errors.
Frequently asked questions
Do I need to buy a certificate for my hosting site?
No. Our web hosting plans include a free SSL certificate. Buy a certificate only if you need organisation or extended validation, or a commercial wildcard certificate.
How long does it take until the certificate is issued?
The free certificate can be issued once your domain points to the hosting account. In cPanel, AutoSSL runs regularly; in Plesk, you issue it yourself with SSL It!.
Does the free certificate renew itself?
Yes. The panel renews free certificates automatically as long as the domain still points to the hosting account.
Why is the padlock missing although HTTPS works?
The page loads some images, scripts or styles over http://. Browsers call this mixed content. Change those addresses to https:// or to relative paths.