Having HTTPS (the padlock in the browser) is no longer optional: it is required so Google does not penalise your site, so browsers do not show "not secure" warnings, and to protect your visitors' data.
Your hosting plan includes AutoSSL with Let's Encrypt, a system that generates and installs the certificate automatically, free of charge and permanently. It renews itself every 90 days with no action from you.
- Make sure your domain already points to our servers. If you just changed nameservers, wait a few hours for propagation (otherwise the system cannot validate the domain).
- Sign in to cPanel from your client area.
- Look for the Security section and click SSL/TLS Status.
- You will see a list of domains and subdomains. If any are marked without SSL, click Run AutoSSL.
- Wait a few minutes. When done, the domains will show the padlock icon.
Force HTTPS on all traffic: once the certificate is installed, you will want visitors arriving via HTTP to be redirected to HTTPS automatically. If you use WordPress, install the Really Simple SSL plugin and it sets everything up in one click. If you prefer to do it manually, add this block at the top of your .htaccess:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Mixed content issues? After forcing HTTPS, some old images or scripts may still load over HTTP and break the padlock. The Really Simple SSL plugin fixes them automatically. If you are not on WordPress, check the source code and change http:// to https:// in absolute URLs.
