Installing an SSL Certificate and Forcing HTTPS

Having a certificate is only half the job — your site also needs to actually use it everywhere, with no leftover insecure content. This guide covers getting the certificate in place and then making https:// the one and only way your site loads.

Step 1 — Make sure a certificate is issued

On cPanel hosting, AutoSSL issues and renews a free certificate for your domains automatically once they point to our servers. To check, open Security → SSL/TLS Status in cPanel: your domain and its www version should show as covered. If a domain is not yet covered, confirm it resolves to us and use the "Run AutoSSL" option. A brand-new domain may take an hour or two after DNS propagates.

Step 2 — Installing a paid certificate (only if you bought one)

If you purchased a certificate rather than using AutoSSL, you will have a certificate file and a private key. In cPanel, open SSL/TLS → Manage SSL sites, choose the domain, and paste the certificate, the private key and any provided chain/CA bundle, then install. If you generated the request (CSR) with us, we can help you complete this from a support ticket.

Step 3 — Force every visitor onto HTTPS

Once the certificate is active, redirect all plain-HTTP traffic to HTTPS so no one ever lands on the insecure version:

• The easy way: many control panels and CMSs have a "Force HTTPS Redirect" toggle. In cPanel look under the Domains area; in WordPress a simple setting or plugin handles it.
• The manual way: add a redirect rule to your site's .htaccess file so requests for http:// are sent to the https:// version with a permanent (301) redirect.

Step 4 — Fix "mixed content"

After forcing HTTPS you may see a warning that the page is not fully secure. This is mixed content: the page itself loads over HTTPS but pulls an image, script or stylesheet over plain HTTP. The fix is to update those references to https:// (or protocol-relative URLs). In WordPress, updating your site URL settings and using a search-and-replace on old http:// links usually clears it. Your browser's developer console will list exactly which resources are the culprits.

Step 5 — Verify

1. Visit your site by typing http:// explicitly and confirm it redirects to https://.
2. Check that the padlock shows with no warnings on your key pages — home, contact, checkout.
3. Test www and non-www, and a few deep links, not just the homepage.

That is it — your site is now encrypted end to end and presents as trustworthy to every visitor and search engine. For the background on what the certificate is doing, see SSL/TLS Certificates Explained.