Type any Veravix client’s domain into a browser without a certificate installed and you’ll see it straight away: a “Not Secure” warning next to the address bar, sometimes a full-page interstitial on Chrome if the site collects any form data at all. It doesn’t matter how good the design is underneath — that single warning is enough to make a visitor bounce before they’ve read a word.
The good news is that setting up an SSL certificate on a WordPress site is far simpler than it used to be. Most hosts now issue free certificates automatically through Let’s Encrypt, and the remaining work is mostly making sure WordPress itself knows to use HTTPS everywhere, not just on the login page. In my experience, this is one of the first things worth checking on any site — new build or inherited — because it affects trust, rankings, and basic data security all at once.
This guide covers checking what your host already offers, enabling the certificate, updating WordPress to serve every page over HTTPS, cleaning up the mixed-content issues that often follow — and a genuine industry shift currently underway that’s worth understanding even if it doesn’t change what you need to do today.
The Short Version
Most WordPress hosts issue a free SSL certificate automatically or with a single click in the hosting control panel, using Let’s Encrypt. Once it’s active, update your WordPress Site Address (URL) and WordPress Address (URL) to use https://, force all traffic to HTTPS with a redirect, and check the site for any leftover http:// references that trigger mixed-content warnings.
Why This Matters
SSL used to be something only ecommerce or banking sites bothered with. That changed once browsers started actively flagging unencrypted pages, and Google confirmed HTTPS as a ranking signal. Today, a site without a valid certificate looks unfinished before a visitor even scrolls, and any contact form, login page, or checkout on that site is sending data in plain text.
There’s also a practical knock-on effect for anything else you’re running on the site. A firewall protects the server from bad requests, but it does nothing to protect the data travelling between the visitor’s browser and your site — that’s what the certificate handles. The two work together, not as substitutes for each other, and skipping one while setting up the other leaves an obvious gap.
If you’re setting up a brand-new WordPress site from scratch, SSL is usually one of the earlier steps rather than something bolted on afterwards — see the step-by-step guide to building a WordPress website for where it fits alongside hosting and domain setup.
Setting It Up
1. Check Whether Your Host Already Provides Free SSL
Log into your hosting control panel and look for a section called SSL, Security, or sometimes just HTTPS. Nearly every mainstream host — Hostinger, SiteGround, Bluehost, and most managed WordPress hosts — now issues free certificates through Let’s Encrypt, a nonprofit certificate authority that automates issuance and renewal. If your host offers this, there’s rarely a reason to pay for a separate certificate on a standard content or small-business site.
2. Enable the SSL Certificate From Your Hosting Control Panel
Select your domain in the SSL section and click Install or Enable. Issuance is usually automatic and takes anywhere from a few seconds to around 20 minutes, depending on the host — it needs to verify you actually control the domain before issuing the certificate. Avoid making DNS changes while this is in progress, since that can interrupt the domain-validation check the certificate authority is running in the background.
3. Update Your WordPress Site URL and Home URL
Once the certificate is active, go to Settings → General in wp-admin and change both WordPress Address (URL) and Site Address (URL) from http:// to https://. Save changes and you’ll be logged out — log back in using the new HTTPS address. If the site becomes inaccessible after this step, the certificate likely hasn’t finished propagating yet; wait a few minutes and try again before troubleshooting further.
4. Force HTTPS Site-Wide
Changing the WordPress URLs doesn’t stop the old http:// address from loading — it just means WordPress generates HTTPS links going forward. To actually redirect old links and bookmarks, add a redirect rule in your .htaccess file (Apache) or your host’s redirect settings, sending all http:// requests to the matching https:// URL. Many hosts include a one-click “Force HTTPS” toggle in the same panel where you enabled the certificate, which avoids editing server files directly. This is also a natural point to review your broader header configuration — if you haven’t already, adding HTTP security headers like HSTS reinforces the HTTPS redirect at the browser level, so it doesn’t fall back to an insecure connection on a repeat visit.
5. Fix Mixed Content Warnings
After forcing HTTPS, load a handful of pages and check the browser console for mixed-content warnings — these appear when a page loads over HTTPS but references an image, script, or stylesheet still hardcoded to http://. This is common on older posts where images were uploaded before SSL was enabled. A search-and-replace tool such as Better Search Replace can update these references across the database in one pass; for a handful of posts, editing them manually is just as quick.
6. Verify the Certificate Is Working Correctly
Load the site in a private browser window and confirm the padlock icon appears with no warnings. Click the padlock to check the certificate’s expiry date and confirm it covers the right domain (and www variant, if you use one). A free SSL checker tool will also flag any lingering mixed-content issues or chain-of-trust problems that aren’t obvious from the address bar alone.
Certificate Lifespans Are Shrinking — Here’s Why That’s Not Actually Your Problem
In April 2025 the CA/Browser Forum — the industry body of browser vendors and certificate authorities that sets the rules every public SSL certificate has to follow — approved a phased reduction in maximum certificate lifetime, moving from the 398-day ceiling that’s applied since 2020 down to a hard maximum of just 47 days by March 2029. The schedule is already underway: as of 15 March 2026, the maximum lifetime any newly issued public certificate can carry dropped to 200 days, with a further cut to 100 days in March 2027 before reaching 47 days in 2029. The stated goal is to shrink the window a compromised or misconfigured certificate stays valid, and to force faster adoption of current cryptographic standards.
If you’re using Let’s Encrypt — which, per the steps above, most WordPress sites are — this changes nothing about what you need to do. Let’s Encrypt has always issued 90-day certificates with automatic renewal baked into its design, well inside every stage of the new ceiling, and your host’s auto-renewal already handles the cycle without any manual action. Where this genuinely matters is for sites using a manually managed certificate from a traditional paid certificate authority with a long-dated renewal cycle: a certificate purchased for a full year before March 2026 will still be honoured for its original term, but any certificate issued or renewed after that date is capped at the new, shorter maximum — meaning manual renewal now needs to happen several times a year, not once every year or two. If your SSL setup is Let’s Encrypt with auto-renewal, as recommended throughout this guide, you’re already ahead of a shift that’s about to make manual certificate management genuinely painful for everyone else.
Practical Tips
- Confirm auto-renewal is switched on. Let’s Encrypt certificates only last 90 days, and most hosts renew them automatically, but it’s worth checking this setting once rather than assuming — a lapsed certificate causes the same “Not Secure” warning as never having one, and with certificate lifetimes now shrinking industry-wide, a manual process that “mostly worked” is more likely to slip through the cracks.
- If you use a CDN or caching layer such as Cloudflare, make sure its SSL mode is set to Full (Strict) rather than Flexible, otherwise traffic between the CDN and your origin server can still travel unencrypted even though visitors see a padlock.
- Update any hardcoded HTTP links in your theme’s header, footer, or widget areas — these are easy to miss because they don’t always trigger a visible console warning on every page.
- Resubmit your sitemap in Search Console after switching to HTTPS. Google treats the HTTPS version as a different URL and needs to be told which one is canonical.
Common Mistakes
- Enabling the certificate at the hosting level but never updating the WordPress Site Address — the site keeps generating HTTP links regardless of the certificate being active.
- Setting up a redirect loop by forcing HTTPS at both the server level and inside a caching plugin, which can leave visitors stuck bouncing between the two.
- Assuming SSL is a one-off task. It’s worth revisiting alongside a periodic security hardening pass, since certificate configuration and header settings tend to drift as plugins and hosting settings change — and with maximum lifetimes now shrinking, a certificate that was set-and-forget in 2024 deserves a second look.
- Leaving old HTTP versions of pages indexed in Google, which splits ranking signals between two versions of the same content instead of consolidating them under HTTPS.
Free vs Paid Certificates
A free Let’s Encrypt certificate is the right choice for the vast majority of content sites, blogs, and small-business sites — it provides the same encryption strength as a paid certificate, just without the extra verification steps. Paid certificates matter mainly for two cases: Extended Validation (EV) certificates, which display the organisation’s verified legal name and suit larger financial or legal institutions, and certain enterprise setups needing a specific warranty or liability guarantee from the certificate authority. For a typical WordPress site, the free option is not a compromise — it’s simply what most established businesses use too, and it’s the option best positioned for the industry’s move toward shorter, automatically renewed certificates.
Conclusion
Enable the free certificate your host almost certainly already offers, update WordPress to use HTTPS everywhere, and check for mixed-content warnings before calling it done. That last step is the one most often skipped, and it’s usually the difference between a padlock that looks right and one that actually is.
Etienne Basson works with website systems, SEO-driven site architecture, and technical implementation. He writes practical guides on building, structuring, and optimizing websites for long-term growth.