HTTPS encrypts traffic between your visitors and the server. Without it, passwords and form submissions travel in plain text and browsers show a "Not secure" warning.
SETTING IT UP
- Point the domain at the nameservers shown in your Client Area.
- cPanel > SSL/TLS Status, tick the domains, click Run AutoSSL.
- Once issued, cPanel > Domains, switch on Force HTTPS Redirect.
- Update your application's configured site address to the https:// version.
Renewal is automatic.
COMMON MISTAKES
Enabling forced HTTPS in cPanel, in .htaccess and in a plugin all at once, which causes a redirect loop. Use one method only. Using Cloudflare with SSL mode set to Flexible. This also causes loops. Use Full (strict) once AutoSSL is issued. Leaving old content pointing at http:// URLs, which produces mixed content warnings and a broken padlock.
WHAT HTTPS DOES NOT DO
It does not make your site secure. It encrypts the connection. A site with a valid certificate can still be running a vulnerable plugin, serving malware, or leaking data. Treat the padlock as one requirement among many, not as proof of safety.
