25 % de remise sur toutes les commandes des nouveaux clients. Parlons-en
Sitefitters
Contact Trouvez votre solution
Learn / How-To Guides

How to Install an SSL Certificate and Force HTTPS

An SSL certificate encrypts the connection between your website and your visitors. It is what puts https and the secure padlock in front of your address. In this guide you will install a free certificate, make every visitor use the secure version and fix the warnings that sometimes appear afterward.

Browsers now label sites without HTTPS as not secure, and many visitors leave when they see that. Google also treats HTTPS as a ranking signal. If your site has a contact form, login or checkout, encryption protects your customers’ details from being read in transit.

⏱ 20 minutes◎ Beginner☰ 8 steps↻ Updated Oct 2026

What you need

  • A domain already pointed to your hosting
  • Your cPanel login or hosting dashboard
  • WordPress admin access, if your site uses WordPress
  • A recent backup of your website

Steps

1

Make sure your domain points to your host

Free certificates are checked automatically, and the check only works when your domain and www both point to your hosting server. If you recently changed DNS, wait until the change has fully spread. Visit your domain without https to confirm it loads your site from your host before you continue. This step prevents most certificate errors.

2

Check the certificate status in cPanel

Log in to cPanel and go to Security, then SSL/TLS Status. You will see each domain and subdomain with an icon showing whether it is secured. Many hosts have AutoSSL turned on, which issues and renews free certificates for you. If your domains already show as AutoSSL Domain Validated, the certificate is installed and you can skip to forcing HTTPS.

3

Run AutoSSL if needed

If any domain shows as unsecured, tick its checkbox and make sure it is included in AutoSSL. Then click Run AutoSSL. The page shows a progress message and reloads when it finishes, usually within a few minutes. If a domain still fails, the Certificate Status column explains why, often that it does not resolve to the server yet.

Tip: Exclude subdomains you do not use, such as old test addresses, so they do not cause AutoSSL errors.
4

Use a paid certificate only if you need one

Free domain validated certificates from AutoSSL or Let’s Encrypt give the same encryption as paid ones. A paid certificate mainly adds company identity checks or a warranty, which some banks or large clients ask for. If you buy one, your provider gives you files to install in cPanel under Security, then SSL/TLS, then Manage SSL sites. Most small businesses never need this.

5

Force HTTPS for every visitor

In cPanel, go to Domains, then Domains. In the list, find your main domain and turn the Force HTTPS Redirect switch to On. Now anyone who types http or follows an old link is sent to the secure version automatically. The switch only works once the domain has a valid certificate, so finish the earlier steps first.

6

Update your WordPress addresses

If you use WordPress, log in and go to Settings, then General. Change both the WordPress Address and Site Address so they start with https instead of http, then save. You will be asked to log in again. This tells WordPress to build every link and image address with the secure version, which helps avoid mixed content warnings.

Tip: Take a backup first, because a typo in these fields can lock you out of the admin area.
7

Fix mixed content warnings

If the padlock is missing or shows a warning, some images, scripts or fonts are still loading over plain http. Open the page, right-click and choose Inspect, then look at the Console tab for messages about mixed content. Update those links in your pages, theme or settings. In WordPress, a reputable search and replace plugin can update old http links in your database.

8

Confirm renewals are automatic

Certificates now last months, not years. Since March 2026, public certificates can be valid for no more than 200 days, and Let’s Encrypt certificates last 90 days, with shorter lifetimes coming. AutoSSL renews them for you. Check SSL/TLS Status every few months, and update Google Search Console so it knows your site now uses https.

Common Mistakes

  • Trying to install a certificate before the domain points to the new host, so the automatic check fails.
  • Forcing HTTPS but leaving images and scripts on http links, which breaks the padlock and can stop parts of the page loading.
  • Installing a paid certificate by hand and forgetting to renew it, which takes the site offline with a browser warning.

FAQ

Is a free SSL certificate safe to use?

Yes. Free certificates from AutoSSL or Let’s Encrypt use the same strong encryption as paid ones and are trusted by every major browser. The difference with paid certificates is extra identity checks on your company or a warranty, not stronger security. For most small business sites, free is the right choice.

Will switching to HTTPS hurt my Google rankings?

Not if you set it up properly. Google prefers HTTPS. Use permanent redirects from http to https, which the cPanel toggle does for you, and update your internal links. Your rankings may move a little for a week or two as Google recrawls, then settle. Add the https version in Search Console.

Why does my site say not secure even with a certificate?

Usually some content on the page still loads over http, which is called mixed content. It can also mean the certificate does not cover the version you are visiting, such as www. Check SSL/TLS Status in cPanel to confirm both versions are covered, then look for http links in your pages and theme.