# Turn on free SSL and force HTTPS on web hosting

> Secure every site on your hosting account with the free certificate: check AutoSSL in cPanel or SSL It! in Plesk, redirect HTTP to HTTPS and fix mixed content.

Difficulty: Beginner

Every web hosting plan includes a **free SSL certificate**. Once your domain points to the hosting account, the panel issues it and renews it. This guide checks the certificate, sends all visitors to HTTPS and fixes the most common warning, **mixed content**, in **cPanel** and **Plesk**.

## Before you start

- Your domain (and `www`) points to the hosting account: either through the hosting nameservers or an A record to the server's IP address; see [point a domain to your server](/guides/point-domain-to-server). Certificates can only be issued after that.
- Your control panel login: [log in to your control panel](/guides/log-in-to-your-control-panel).

## Step 1: Check that the certificate is issued

**cPanel**

Open **SSL/TLS Status**. It lists your domains with their certificate. Domains secured by the free certificate show an **AutoSSL DV Certificate**; domains that could not be secured are marked **Has AutoSSL Problems**, with the reason.
**Plesk**

Open **Websites & Domains** and the domain's **SSL/TLS Certificates** (the **SSL It!** extension). Choose to install the free certificate, include the `www` name, and confirm.

**Verify:** `https://example.com` and `https://www.example.com` open with a padlock in the browser.

## Step 2: Send everyone to HTTPS

**cPanel**

Open **Domains** and turn on **Force HTTPS Redirect** for the domain. The switch is available once the domain has a valid certificate.
**Plesk**

Open the domain's **Hosting Settings** and tick **Permanent SEO-safe 301 redirect from HTTP to HTTPS**, then select **OK**.

**Verify:** typing `http://example.com` in the browser ends at `https://example.com`.

## Step 3: Update your site's own address

Applications store their address. Change it to `https://`:

- **WordPress:** **Settings › General**, set **WordPress Address (URL)** and **Site Address (URL)** to `https://example.com`.
- **Other applications:** look for a "base URL" or "site URL" setting in their configuration.

## Step 4: Fix mixed content

When an HTTPS page loads images, scripts or styles over `http://`, browsers block some of them or remove the padlock. Open the browser's developer tools (`F12`), look at the **Console** for "mixed content" messages and change the listed addresses to `https://`. In WordPress, links stored in posts may need a search-and-replace of `http://example.com` with `https://example.com` (back up the database first).

## Troubleshooting

**cPanel shows "Has AutoSSL Problems" for `www` or the domain.** That name does not point to the hosting server, or a DNS record (for example a CAA record) prevents issuance. Fix DNS and wait for the next AutoSSL run.

**Plesk cannot issue the certificate.** The domain or `www` does not point to the server yet, or the site blocks the validation check. Check DNS and try again.

**`ERR_TOO_MANY_REDIRECTS` after turning on the redirect.** The site redirects twice, for example through the panel and through a plugin or a proxy such as Cloudflare. Keep one redirect; with Cloudflare, use **Full (strict)** SSL mode; see [Cloudflare proxy setup](/guides/cloudflare-proxy-setup).

**Certificate errors in the browser.** See [fix SSL certificate errors](/guides/fix-ssl-certificate-errors).

## Next steps

- Paid certificates with organisation validation: [order, validate and install an SSL certificate](/guides/install-ssl-certificate).
- Certificate problems: [fix SSL certificate errors](/guides/fix-ssl-certificate-errors).

## Frequently asked questions

### Do I need to buy a certificate for my hosting site?

No. Our web hosting plans include a free SSL certificate. Buy a certificate only if you need organisation or extended validation, or a commercial wildcard certificate.

### How long does it take until the certificate is issued?

The free certificate can be issued once your domain points to the hosting account. In cPanel, AutoSSL runs regularly; in Plesk, you issue it yourself with SSL It!.

### Does the free certificate renew itself?

Yes. The panel renews free certificates automatically as long as the domain still points to the hosting account.

### Why is the padlock missing although HTTPS works?

The page loads some images, scripts or styles over http://. Browsers call this mixed content. Change those addresses to https:// or to relative paths.

---

Source: <https://hyperdc.com/guides/products/hosting-free-ssl-https>\
Updated: 2026-10-15