How to install a free SSL certificate on cPanel and force HTTPS

Before you start

An SSL certificate encrypts the connection between your site and its visitors, removes the browser's “Not secure” warning and is a basic requirement for forms, online stores and Google rankings. If you want to understand how it works, read what an SSL certificate is. Here we go straight to installing one.

To follow this guide you need:

• Access to your cPanel with the details from your welcome email.
• Your domain already pointing to the server. If it doesn't yet, first follow the guide to point your domain to your hosting.
• A recent backup of your site, especially if you run WordPress.

Step 1: turn on free SSL with AutoSSL

Most cPanel servers include AutoSSL, which issues and renews free certificates (from Let's Encrypt or another authority chosen by the provider) for your main domain, subdomains and addon domains. It usually runs on its own, but you can check it and trigger it like this:

1. Log in to cPanel and, under Security, open SSL/TLS Status.
2. Review the list of domains. A green lock means they already have a valid certificate; a red or grey one means it's missing or about to expire.
3. Click Run AutoSSL and wait a few minutes. Don't close the page until it finishes.
4. When it's done, reload the page and confirm that yourbusiness.com and www.yourbusiness.com show a green lock.
5. Open your site with https:// in a private window to check that the browser shows the connection as secure.

Step 2 (optional): install a paid certificate

If you bought a commercial certificate, installing it in cPanel involves three pieces: the request (CSR), the certificate (CRT) and the authority's chain (CA bundle).

1. In cPanel open SSL/TLS and go to Certificate Signing Requests (CSR).
2. Generate a request with your domain, your company's legal name, city and country. cPanel creates the private key at the same time and stores it on the server.
3. Copy the full CSR text and paste it into the authority's order form.
4. Complete the validation they ask for: an email to an address on the domain, a DNS record or a file on your site. For OV and EV they will also verify your company details.
5. Once it's issued, go back to SSL/TLS, open Manage SSL sites, pick your domain and paste the CRT contents.
6. Use Autofill by Certificate so cPanel finds the private key and, if it doesn't fill in the chain, paste the CA bundle the authority sent you.
7. Click Install Certificate. AutoSSL won't replace a valid paid certificate.

When is a paid certificate worth it?

For most sites, a free certificate encrypts just as well as a paid one. An OV or EV certificate makes sense when a client, bank or tender requires company validation, when you need a commercial warranty or when you want direct support from the authority. Keep in mind that since March 2026 public certificates last at most 200 days, so even with a yearly plan you'll have to reissue and reinstall it halfway through.

Step 3: force HTTPS across the site

Having a certificate isn't enough: if someone types your domain without https://, they should land on the secure version. The simplest way in cPanel is:

1. Open Domains under the Domains section.
2. Turn on the Force HTTPS Redirect toggle for your domain. It's only available once the domain has a valid certificate.
3. Visit http://yourbusiness.com and confirm it sends you to HTTPS.

If you'd rather control it from the site, add these lines at the top of the .htaccess file in public_html (use only one of the two methods):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]

The 301 redirect tells Google that the HTTPS address is the permanent one, so you keep your rankings.

Step 4: WordPress and mixed content

If your site runs WordPress, update its addresses so everything is generated over HTTPS (if you haven't installed it yet, see how to install WordPress on cPanel):

1. Go to Settings → General and change the WordPress Address and Site Address to https://yourbusiness.com.
2. Save. WordPress will log you out; log back in.
3. Replace the old URLs in the database. With WP-CLI from cPanel's Terminal you can do it in one step; a search-and-replace plugin works too.

cd ~/public_html
wp search-replace 'http://yourbusiness.com' 'https://yourbusiness.com' --skip-columns=guid --dry-run
wp search-replace 'http://yourbusiness.com' 'https://yourbusiness.com' --skip-columns=guid

The first command with --dry-run only reports how many changes it would make. Run the second when you're happy with it. If you still see a lock with a warning, open the browser's developer tools (F12), Console tab, and look for Mixed Content warnings: they tell you which image, script or stylesheet is still loading over http://. They usually live in the theme, widgets or hand-pasted code.

Step 5: renewal without surprises

AutoSSL certificates are short-lived (currently 90 days with Let's Encrypt) and renew automatically a few days before they expire, as long as the domain still points to the server and validation works. To avoid surprises:

• Check SSL/TLS Status from time to time, especially after changing DNS.
• Read the AutoSSL notices sent to your cPanel contact email; they warn you when a domain couldn't be renewed.
• If you use a paid certificate, note its expiry date and reissue it ahead of time.

Common errors and how to fix them

If validation keeps failing, make sure your .htaccess doesn't redirect or block the /.well-known/ folder, which is where the authority looks for the verification file. A properly installed SSL certificate is one more layer of your site's security; if you use WordPress, round it out with our guide to WordPress security.