Every domain hosted with us is entitled to a free AutoSSL certificate. Once it is issued you should force all traffic to HTTPS so visitors never land on the insecure version.
1. Issue the certificate
- Point the domain at our nameservers first — AutoSSL cannot validate a domain that does not resolve to the server.
- In cPanel open SSL/TLS Status under Security.
- Tick the domain and any subdomains, then click Run AutoSSL.
- Wait a few minutes and refresh. A green padlock next to each entry means the certificate is active.
If AutoSSL fails, the usual causes are: the domain is not yet pointing at us, the domain is proxied through Cloudflare in a mode that blocks validation, or an existing redirect is intercepting the /.well-known/ path.
2. Update the WordPress addresses
In the dashboard go to Settings → General and make sure both WordPress Address (URL) and Site Address (URL) begin with https://. Save.
3. Force the redirect
The simplest method is cPanel: open Domains, find your domain and switch Force HTTPS Redirect on.
Alternatively add this to the top of public_html/.htaccess, above the WordPress block:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Use one method or the other, never both — duplicated rules cause redirect loops.
If the padlock still shows a warning after this, see our article on fixing mixed content warnings.
