If your WordPress site still shows “Not Secure” in the browser bar, you’re losing visitors, conversions, and Google ranking points. The good news? You can install an SSL certificate on WordPress for free, in less than 30 minutes, even without technical skills.
In this practical guide, we’ll walk you through obtaining a free Let’s Encrypt SSL certificate, installing it on your WordPress site, forcing HTTPS site-wide, and fixing the dreaded mixed content warnings.
Why You Need an SSL Certificate on WordPress
Before we dive into the steps, here’s why SSL is non-negotiable in 2026:
- SEO boost: Google has used HTTPS as a ranking signal since 2014, and the gap keeps widening.
- User trust: Modern browsers display warnings on non-HTTPS sites, scaring visitors away.
- Data security: SSL encrypts data exchanged between your visitors and your server (logins, forms, payments).
- Required for modern features: Many APIs, payment gateways, and PWA features only work over HTTPS.
What You’ll Need Before Starting
- A WordPress site already online with a registered domain name
- Access to your hosting control panel (cPanel, Plesk, or your host’s custom dashboard)
- Access to your WordPress admin dashboard
- About 20 to 30 minutes
Step 1: Check If Your Host Already Provides Free SSL
Most modern hosting providers include free Let’s Encrypt SSL out of the box. Before doing anything manually, check your hosting dashboard.
| Hosting Provider | Free SSL Available? | Where to Find It |
|---|---|---|
| SiteGround | Yes (auto) | Site Tools > Security > SSL Manager |
| Bluehost | Yes | My Sites > Manage Site > Security |
| Hostinger | Yes | hPanel > SSL |
| cPanel hosts | Yes (usually) | cPanel > SSL/TLS Status or Let’s Encrypt |
| WP Engine / Kinsta | Yes (auto) | Enabled by default |
If you find a one-click activation option, click it, wait a few minutes, and skip ahead to Step 4.
Step 2: Install a Free Let’s Encrypt SSL Certificate via cPanel
If your host uses cPanel but doesn’t auto-issue SSL, here’s how to do it manually:
- Log in to your cPanel account.
- Scroll to the Security section and click on Let’s Encrypt SSL (or SSL/TLS Status).
- You’ll see a list of your domains. Click Issue next to the domain you want to secure.
- Select both
yourdomain.comandwww.yourdomain.com(and any subdomains you need). - Click Issue and wait 1 to 2 minutes for the certificate to be generated and installed.
That’s it for the server side. The certificate auto-renews every 90 days.
What If My Host Doesn’t Offer Let’s Encrypt?
If your host charges for SSL or doesn’t integrate Let’s Encrypt, two solutions:
- Use Cloudflare (recommended for non-technical users): sign up for a free Cloudflare account, point your domain’s nameservers to Cloudflare, and SSL is activated automatically.
- Switch hosting: it’s 2026, free SSL should be standard. Consider moving to a host that includes it.
Step 3: Update WordPress to Use HTTPS
Once the certificate is active on the server, you need to tell WordPress to use HTTPS.
- Go to your WordPress admin dashboard.
- Navigate to Settings > General.
- Change WordPress Address (URL) from
http://tohttps://. - Change Site Address (URL) the same way.
- Click Save Changes. You’ll be logged out and asked to log back in.
Step 4: Force HTTPS Site-Wide and Fix Mixed Content
Even after switching the WordPress URLs, you might still have old http:// links embedded in your content, theme, or database. This causes the famous “mixed content” warning.
The easiest fix is to install the Really Simple SSL plugin:
- In your WordPress dashboard, go to Plugins > Add New.
- Search for Really Simple SSL.
- Click Install Now, then Activate.
- Click the big “Activate SSL” button in the plugin notice.
The plugin will:
- Automatically redirect all HTTP traffic to HTTPS
- Rewrite insecure resources on the fly
- Set the proper security headers
Manual Method (For Advanced Users)
If you prefer not to use a plugin, add this snippet to your .htaccess file (before the WordPress block):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Then run a search-and-replace in your database using the Better Search Replace plugin to replace every instance of http://yourdomain.com with https://yourdomain.com.
Step 5: Verify Your SSL Installation
After everything is in place, verify your work:
- Visit your site and look for the padlock icon in the address bar.
- Use SSL Labs Server Test to get a detailed grade (aim for A or A+).
- Use Why No Padlock to detect remaining mixed content issues.
- In Chrome DevTools (F12), open the Console tab and look for any “Mixed Content” warnings.
Step 6: Update Google Search Console and Analytics
Don’t forget this critical post-migration step:
- Add the HTTPS version of your site as a new property in Google Search Console.
- Resubmit your XML sitemap.
- Update the default URL in Google Analytics to
https://. - Update any hardcoded URLs in your Google Ads, social media bios, and email signatures.
Common Issues and How to Fix Them
Too Many Redirects Error
This usually happens behind a CDN like Cloudflare. In Cloudflare’s SSL/TLS settings, switch the mode from Flexible to Full or Full (Strict).
Padlock Missing on Some Pages
An image, script, or iframe is still loading over HTTP. Use the browser console to identify the offender, then update the URL in your content or theme files.
Certificate Not Renewing
Let’s Encrypt certificates last 90 days. Most hosts auto-renew, but if you installed it manually, set a calendar reminder or use a tool like Certbot with a cron job.
FAQ
Does WordPress include an SSL certificate by default?
WordPress.com hosted sites include SSL automatically. For self-hosted WordPress.org sites, SSL depends on your hosting provider, though most modern hosts now offer free Let’s Encrypt certificates.
How much does an SSL certificate cost for WordPress?
It can be completely free using Let’s Encrypt or Cloudflare. Paid certificates (Sectigo, DigiCert, GoDaddy) range from $10 to several hundred dollars per year and are mainly needed for extended validation (EV) or wildcard certificates on large enterprise sites.
Will installing SSL hurt my SEO?
Quite the opposite. Done correctly with proper 301 redirects, switching to HTTPS will improve your rankings. Just make sure to update Google Search Console with the new HTTPS property.
Do I need to back up my site before installing SSL?
Yes, always. Use a plugin like UpdraftPlus or your host’s backup tool before making URL changes or installing redirect plugins.
What’s the difference between Let’s Encrypt and a paid SSL?
For 99% of WordPress sites (blogs, small businesses, e-commerce with Stripe/PayPal), Let’s Encrypt provides the exact same encryption strength as a paid certificate. Paid SSLs mainly add organization validation badges and warranty coverage.
Final Thoughts
Installing an SSL certificate on WordPress in 2026 is no longer a complex, expensive task. With Let’s Encrypt, modern hosting panels, and plugins like Really Simple SSL, any site owner can secure their site in under half an hour.
Need help migrating your WordPress site to HTTPS or want a professional to handle the entire setup? Get in touch with our team and we’ll take care of it for you.