How to Set Up Free SSL (HTTPS) on Your Website Using Let's Encrypt

Every website in 2026 needs SSL. Without it, browsers display a "Not Secure" warning that scares visitors away, Google ranks your pages lower, and any data your visitors submit (login forms, contact forms, payment info) is transmitted in plain text that anyone on the network can intercept.

The good news: SSL certificates are free. Let's Encrypt, a nonprofit certificate authority backed by the Internet Security Research Group, issues millions of free SSL certificates every day. Most hosting providers have built-in tools that make installation a one-click process.

What SSL Actually Does

SSL (Secure Sockets Layer) — technically now called TLS (Transport Layer Security) — encrypts the connection between your website's server and your visitor's browser. Here is what that means in practice:

• Encryption: Data transmitted between the browser and server is encrypted, making it unreadable to anyone who intercepts it.
• Authentication: The SSL certificate proves that your website is genuinely hosted on the server it claims to be on, preventing man-in-the-middle attacks.
• Data Integrity: SSL ensures that data is not altered during transfer. What the visitor sends is exactly what your server receives.

Visually, SSL manifests as the padlock icon in the browser address bar and the https:// prefix instead of http://.

Method 1: cPanel AutoSSL (Easiest)

If your hosting provider uses cPanel, SSL installation is built right in. Most cPanel hosts include AutoSSL, which automatically provisions and renews Let's Encrypt or Sectigo certificates for all your domains.

Step 1: Check SSL Status

1. Log in to your cPanel dashboard.
2. Go to Security → SSL/TLS Status.
3. You will see a list of all domains on your account. If a green padlock appears next to your domain, SSL is already active.

Step 2: Run AutoSSL (if not already active)

1. If your domain shows a red X or yellow warning, click Run AutoSSL in the top-right corner.
2. AutoSSL will validate your domain and install a certificate. This process takes 1–5 minutes.
3. Once complete, refresh the page. Your domain should now show a green padlock.

Step 3: Force HTTPS via .htaccess

After installing SSL, you need to ensure all visitors are redirected from HTTP to HTTPS. Add this to the top of your .htaccess file (in cPanel, go to File Manager → public_html → .htaccess):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This creates a permanent (301) redirect from HTTP to HTTPS for all pages on your site.

Method 2: Let's Encrypt via cPanel Plugin

Some hosting providers include a dedicated Let's Encrypt plugin in cPanel that gives you more control over certificate issuance.

1. In cPanel, look for Let's Encrypt SSL or SSL/TLS under the Security section.
2. Click Issue next to the domain you want to secure.
3. Select whether you want to include www and non-www versions (recommended: include both).
4. Click Issue Certificate.
5. The certificate will be installed within 1–2 minutes.

The Let's Encrypt plugin also handles automatic renewal. Certificates are valid for 90 days and are renewed automatically 30 days before expiration.

Method 3: Certbot via SSH (Command Line)

If you have SSH access to your server (common on VPS and cloud hosting plans), Certbot is the official Let's Encrypt client and offers the most control.

Step 1: Install Certbot

On Ubuntu/Debian servers:

sudo apt update
sudo apt install certbot python3-certbot-apache

On CentOS/RHEL servers:

sudo yum install epel-release
sudo yum install certbot python3-certbot-apache

Step 2: Obtain the Certificate

For Apache:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

For Nginx:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot will automatically configure your web server to use SSL and set up the HTTPS redirect.

Step 3: Verify Auto-Renewal

sudo certbot renew --dry-run

If this command completes without errors, automatic renewal is working. Certbot sets up a cron job that runs twice daily to check for upcoming expirations.

Configuring WordPress for HTTPS

After installing your SSL certificate, you need to update WordPress to use HTTPS. Without this step, your site may load over HTTPS but still reference HTTP resources (images, scripts, stylesheets), causing "mixed content" warnings.

Step 1: Update WordPress URLs

1. Log in to your WordPress dashboard at https://yourdomain.com/wp-admin.
2. Go to Settings → General.
3. Change both WordPress Address (URL) and Site Address (URL) from http:// to https://.
4. Click Save Changes. You will be logged out and need to log in again using the HTTPS URL.

Step 2: Fix Mixed Content

Mixed content occurs when your HTTPS page loads resources (images, CSS, JavaScript) over HTTP. Browsers block these resources, which can break your site's appearance or functionality.

The easiest fix is to install the Really Simple SSL plugin:

1. Go to Plugins → Add New and search for "Really Simple SSL."
2. Install and activate it.
3. The plugin will automatically detect your SSL certificate and fix mixed content issues.

Alternatively, you can manually find and replace HTTP URLs in your database. Connect to your WordPress database via phpMyAdmin or WP-CLI and run:

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables

Step 3: Update Your .htaccess

If you have not already added the HTTPS redirect (from Method 1, Step 3), add it now. Also, add HSTS (HTTP Strict Transport Security) to tell browsers to always use HTTPS:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

"HSTS is a security header that tells browsers: once you have connected to this site over HTTPS, never try HTTP again. It eliminates the brief moment of vulnerability that occurs during the HTTP-to-HTTPS redirect."

Verifying Your SSL Installation

After installation, verify everything is working correctly:

1. Browser check: Visit your website and look for the padlock icon in the address bar. Click it to view certificate details.
2. SSL Labs test: Go to ssllabs.com/ssltest and enter your domain. Aim for an A or A+ rating.
3. Mixed content check: Open your browser's developer tools (F12), go to the Console tab, and look for mixed content warnings.
4. Redirect check: Type http://yourdomain.com in your browser. It should automatically redirect to https://yourdomain.com.

SSL Certificate Types Compared

For the vast majority of websites, a free DV certificate from Let's Encrypt provides the same encryption strength as a $500 EV certificate. The only difference is the level of identity verification, which matters primarily for large financial institutions.

Troubleshooting Common SSL Issues

ERR_TOO_MANY_REDIRECTS

This usually happens when your server and WordPress are both trying to redirect to HTTPS, creating an infinite loop. If you are behind a reverse proxy or CDN like Cloudflare, add this to your wp-config.php:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
}

Certificate Not Trusted

This means the full certificate chain is not installed. In cPanel, go to SSL/TLS → Manage SSL Sites and make sure the Certificate Authority Bundle (CA Bundle) field is populated. AutoSSL handles this automatically.

AutoSSL Fails to Issue Certificate

Common causes: your domain is not pointed to your server (check DNS), your .htaccess is blocking the validation request, or you have a firewall rule blocking Let's Encrypt. Make sure your domain resolves to your hosting server's IP address before running AutoSSL.

Frequently Asked Questions

Is Let's Encrypt SSL as secure as paid SSL?

Yes. Let's Encrypt uses the same 256-bit encryption as paid certificates. The encryption strength is identical. Paid certificates offer additional features like warranty, organization validation, and extended validation (green bar), but the actual security is the same.

How often do Let's Encrypt certificates renew?

Let's Encrypt certificates are valid for 90 days. Most hosting providers (including Serverlys) auto-renew them 30 days before expiration. You should never need to manually renew.

Will SSL slow down my website?

No. Modern SSL/TLS adds negligible overhead (less than 1ms per request). In fact, HTTPS enables HTTP/2 and HTTP/3, which can actually make your site faster by allowing multiplexed connections and header compression.

Do I need SSL if I do not collect sensitive data?

Yes. Even if you do not have forms or logins, Google uses HTTPS as a ranking factor, and browsers show "Not Secure" warnings on HTTP pages. SSL is essential for credibility and SEO regardless of what data you collect.

Can I use SSL with Cloudflare?

Yes. If you use Cloudflare, set the SSL mode to "Full (Strict)" to encrypt traffic both between visitors and Cloudflare, and between Cloudflare and your server. This requires a valid SSL certificate on your origin server (which Let's Encrypt provides).