Free SSL on cPanel: how to set it up and what breaks afterwards

There is no good reason to run a site without HTTPS any more. Certificates are free, browsers mark plain HTTP as "Not secure", and Google has treated it as a ranking signal for years. On any modern cPanel host it is a two-minute job.

The part people underestimate is what happens afterwards.

Issuing the certificate

Most cPanel hosts run AutoSSL, which issues and renews Let's Encrypt certificates automatically. Usually you do nothing at all — point the domain at the server, wait for DNS to settle, and a certificate appears within a few hours.

If it has not, open SSL/TLS Status in cPanel, tick the domain, and press Run AutoSSL. When it fails, it is nearly always one of these:

• DNS still points at your old host, so the validation request never reaches this server.
• The domain is behind Cloudflare with the proxy on, and the validation path is being intercepted.
• A stray .htaccess redirect is bouncing the validation request before it can be answered.

Then force HTTPS

A certificate does not redirect anything. Until you force it, both versions of the site stay reachable, which is bad for SEO — search engines can treat them as duplicate sites.

cPanel has a Force HTTPS Redirect toggle in the Domains area. Use that in preference to hand-writing rewrite rules; it survives things that hand-edited .htaccess files do not.

The bit that actually costs you time

Your padlock appears, then shows a warning anyway. That is mixed content: the page loaded over HTTPS but something inside it — an image, a stylesheet, a script — is still requested over HTTP, and the browser refuses to treat the page as fully secure.

On WordPress this is usually old content with absolute http:// URLs baked into it. The fix:

1. Update WordPress Address and Site Address under Settings → General to the https:// versions.
2. Run a search-and-replace across the database for http://yourdomain → https://yourdomain. Use a proper migration plugin rather than raw SQL — serialised PHP in the options table will corrupt if you edit it naively.
3. Reload with the browser console open and fix whatever still complains. Hardcoded URLs in theme files are the usual last offender.

Renewal

Let's Encrypt certificates last 90 days. AutoSSL renews them for you, so this is normally invisible — but if you ever move DNS away and back, check SSL/TLS Status afterwards rather than assuming. An expired certificate is a far uglier browser warning than no certificate at all.