How to get a free SSL certificate for your WordPress site

You can get a free SSL certificate for a WordPress site from your hosting control panel, where cPanel’s AutoSSL issues one for each domain, or from Let’s Encrypt, which does not charge for its certificates. Once the certificate is in place, switch both WordPress addresses to https, redirect http to https, and fix any page that still loads images or scripts over http. For a normal website or shop, a free certificate is all you need.

This guide covers where free certificates come from, how long they last and why that matters, how to check yours, and how to move WordPress to https without breaking links or getting “Not secure” warnings.

What is an SSL certificate, and why does WordPress need one?

An SSL certificate (the current technology is called TLS, but most people still say SSL) lets a browser open an encrypted connection to your site and confirm it is talking to your domain. Browsers show the padlock when it works and “Not secure” when the site uses plain http.

WordPress’s own HTTPS guide gives three reasons to use it:

• Speed. Many newer browser features that make pages load faster only work over https.
• Payment security. If you sell anything, customers need to know their details travel safely.
• Search. The guide notes that many search engines penalise sites that do not use https.

The same guide says WordPress works fully over https once a certificate is installed, and strongly recommends it to protect logins and visitors. If you take card payments, your payment gateway’s return pages and your checkout need https too.

Is a free SSL certificate as good as a paid one?

For encryption, yes. A free certificate and a paid one set up the same kind of encrypted connection. The difference is in what the certificate authority checked before it issued the certificate.

• Domain validated (DV) certificates prove you control the domain. Let’s Encrypt’s FAQ says it offers only this type, because it can be automated.
• Organisation validated (OV) and extended validation (EV) certificates also check your company’s details, by hand, and cost money.

A blog, a business site or a WooCommerce shop does not need OV or EV to show the padlock or to take payments through a gateway. Buy one only if a policy, a bank or a contract asks for it. Otherwise a free DV certificate is enough.

Let’s Encrypt says it does not charge for certificates, though some hosting companies add a small fee for managing them. If your host uses cPanel, open SSL/TLS Status before you pay anyone for SSL, because AutoSSL may already cover your domain.

How do you get a free certificate in cPanel?

cPanel’s AutoSSL issues domain-validated certificates for the domains on your account. You check it in the SSL/TLS Status screen, which cPanel’s SSL/TLS Status documentation describes:

1. Make sure the domain already points to your hosting. AutoSSL has to reach your site through the domain to prove you control it.
2. Log in to cPanel and open SSL/TLS Status.
3. Find your domain in the list and look at its status. The screen can filter domains with expired certificates, certificates that expire soon, and AutoSSL problems.
4. If the domain has no certificate, click Run AutoSSL and wait a few minutes.
5. If it still fails, read the error shown next to the domain. A common one is a domain that does not yet resolve to the server, for example because a nameserver change is still spreading.

Our help guide on getting https working has the same steps for our servers. If your domain is new, see how to point your domain to your hosting first, because AutoSSL cannot issue a certificate until the domain resolves to the server.

How long does a free certificate last?

Let’s Encrypt’s FAQ says its default certificates last 90 days, and it recommends renewing every 60 days. It also offers six-day certificates for those who opt in. There are no exceptions to those lifetimes.

Paying does not get you out of renewals for long either. The CA/Browser Forum, the body of browser makers and certificate authorities that sets the rules, passed ballot SC-081. It cuts the maximum life of every public TLS certificate in steps, from 398 days down to 47 days. That applies to paid certificates too.

So the useful question is not how long a certificate lasts. It is whether it renews by itself. Let’s Encrypt is built around automatic renewal, and on our servers AutoSSL renews certificates by itself. On other hosts, ask whether AutoSSL runs for your account. A certificate you install by hand expires on its date whether or not anyone remembers, and visitors then see a full-page warning until someone replaces it.

We checked the certificate on this site with the command in the next section. It is a free certificate from Google Trust Services, valid for 90 days, and it covers the main domain plus a wildcard for its subdomains. Nobody renews it by hand.

How do you check your site’s certificate?

In a browser, click the icon to the left of the address, then open the certificate details. Look at three things:

• Issued to. The names it covers. It should include both yourdomain.com and www.yourdomain.com, or a wildcard such as *.yourdomain.com.
• Issued by. The certificate authority.
• Valid until. The expiry date. If it is less than a few weeks away and has never renewed before, check that automatic renewal is on.

From a terminal, the openssl tool shows the same details:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -issuer -dates -ext subjectAltName

The output lists the issuer, the start and end dates, and every name on the certificate.

How do you switch WordPress to https?

Take a backup first. Then:

1. Change both addresses. In WordPress, open Settings, then General. Change WordPress Address and Site Address so both start with https://. Save. WordPress logs you out, so log in again at the https address.
2. Redirect http to https. In cPanel, the Domains screen has a Force HTTPS Redirect toggle for each domain, according to cPanel’s Domains documentation. Turn it on so old http links land on the secure version.
3. Force secure logins. WordPress’s HTTPS guide describes the FORCE_SSL_ADMIN setting. Add define( 'FORCE_SSL_ADMIN', true ); to wp-config.php so every login and admin session uses https.
4. Update old links in your content. Posts and pages written before the switch may still contain http:// links to your own images. See the next section.
5. Test. Open your home page, a post, a form and, for a shop, the cart and checkout in a private window. Each should show the padlock.

Why does the site still say “Not secure” after the switch?

Usually because a page loads something over plain http, such as an image, a script or a font. This is called mixed content, and browsers either block the item or drop the padlock for the whole page.

To find it, open the page, press F12 to open the browser’s developer tools, and look in the Console tab for warnings that mention http://. The address in the warning tells you which file is the problem.

To fix it across the whole site, replace your old http address with the https one in the database. If you have WP-CLI, its search-replace command does this safely, and its documentation includes a dry-run option that shows what would change first:

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guid --dry-run

Run it again without –dry-run once the preview looks right. The –skip-columns=guid part leaves WordPress’s internal post IDs alone, as the documentation’s own examples do. The documentation also says it handles PHP serialized data, the format WordPress uses for many stored settings. A plain text search-and-replace on a database export does not, and can break those settings, so if you do not have WP-CLI, ask your host.

If the warning comes from a theme or plugin file with a hard-coded http address, update that theme or plugin, or ask its developer.

What should you do after https works?

• Add the https version of your site in Google Search Console if you use it. Google’s page experience documentation points to Search Console’s HTTPS report, which shows whether your pages are served over https and what to fix.
• Update your site address on social profiles, your email signature and any payment gateway settings that store your return addresses.
• Check that your contact forms and order emails still arrive. Some form plugins store the site address in their settings.
• Run a speed test again. Our guide to why a WordPress site is slow in Pakistan shows how to measure it.

Frequently asked questions

How much does an SSL certificate cost in Pakistan?

A domain-validated certificate is free from Let’s Encrypt, and cPanel hosting with AutoSSL switched on includes free certificates too. You only need to pay if a client, bank or contract asks for an organisation-validated or extended validation certificate.

Do free SSL certificates expire?

Yes. Let’s Encrypt certificates last 90 days by default, so they have to renew automatically. Paid certificates expire too, and the CA/Browser Forum is cutting the maximum lifetime of all public certificates to 47 days in steps.

Why is AutoSSL not issuing a certificate for my domain?

First check that the domain points to the server. cPanel’s documentation gives a domain that does not resolve as an example of an AutoSSL problem. Check that your nameservers or A record point to your hosting, wait for the change to spread, then click Run AutoSSL in SSL/TLS Status again.

Do I still need the http version of my site after the switch?

Keep it only as a redirect. Every old http address should send visitors to its https version, so old links and bookmarks keep working. The Force HTTPS Redirect toggle in cPanel’s Domains screen does this for the whole domain.

Does a WooCommerce store need a special SSL certificate?

No. A free domain-validated certificate encrypts the checkout the same way a paid one does. What matters is that every page, including the cart and checkout, loads over https with no mixed content.