An SSL certificate (technically a TLS certificate today) encrypts the connection between your website and its visitors. It’s what puts https:// and the padlock in the address bar.
Without one, browsers label your site “Not secure,” forms can’t be submitted safely, and search engines favor your competitors. The good news: for most websites, a certificate is free and takes minutes to set up.
Step 1: Check whether you already have one
Visit your site using https:// at the start of the address. If the page loads with a padlock and no warning, you have a working certificate. You can also check your site free with Repork, which shows whether your certificate is valid and when it expires.
Step 2: Get a free certificate from your host
Most hosting companies provide free certificates from Let’s Encrypt or a similar authority, and many install them automatically. Look for one of these:
- cPanel hosting: open SSL/TLS Status, select your domains, and click Run AutoSSL.
- Managed WordPress hosts: look for an SSL or HTTPS setting in the site’s dashboard and switch it on.
- Cloudflare: if your site uses Cloudflare, it can provide the certificate visitors see. Set the SSL mode to Full (strict) and make sure your server also has a certificate.
Include both versions of your domain, with and without www. A certificate that covers only one of them causes a warning on the other.
Free certificates encrypt traffic exactly as well as paid ones. Paid certificates mainly add organization validation or a warranty, which some businesses and industries require.
Step 3: Switch WordPress to HTTPS
In WordPress, go to Settings → General and change both WordPress Address and Site Address from http:// to https://. Save, and you’ll be asked to log in again.
Step 4: Redirect all traffic to HTTPS
Many hosts have a “Force HTTPS” switch. If yours doesn’t, and your server runs Apache, add these lines at the top of the .htaccess file in your site’s root folder:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]If your site sits behind Cloudflare or another proxy, use the proxy’s “Always Use HTTPS” setting instead, which avoids redirect loops.
Step 5: Fix mixed content
If the padlock is missing on some pages, they’re loading images, scripts, or fonts over plain http://. In WordPress this usually comes from old links saved in posts and settings.
- Back up your database first. See how to set up remote WordPress backups.
- Install a search-and-replace plugin such as Better Search Replace.
- Replace
http://yourdomain.comwithhttps://yourdomain.comacross all tables. Run it as a dry run first to see what will change. - Clear any caching plugin and your browser cache, then check the pages again.
Your browser’s developer tools (the Console tab) list any remaining insecure files on a page.
Step 6: Update Google
In Google Search Console, make sure the https:// version of your site is verified (a Domain property covers both automatically). Update your website address in Google Analytics, Google Business Profile, and your social profiles too.
Don’t let it expire
Free certificates are short-lived, typically 90 days, and renew automatically. Automatic renewal usually works, until a DNS change or hosting move quietly breaks it. Then visitors see a full-page security warning.
Checking your certificate’s expiry date regularly takes the surprise out of it. The Repork dashboard is designed to watch your certificate alongside uptime and security, so you hear about a problem before your visitors do.
Learn more about how SSL certificates protect your website.
