Free SSL on Shared Hosting: Setup, Auto-Renewal and Fixing the Broken Padlock

Free SSL via Let's Encrypt has become standard on quality cPanel shared hosting, but installing the certificate is only step one. A large share of sites with a "working" SSL certificate still show a broken or partial padlock warning in the browser, because the certificate itself isn't the whole story — mixed content is.

Setting Up Free SSL on cPanel Shared Hosting

  1. In cPanel, locate "SSL/TLS Status" or "Let's Encrypt SSL," depending on the specific panel version.
  2. Select the domain (and any subdomains, like www) that need coverage — a certificate not covering the www variant is a common gap that leaves that specific URL unsecured.
  3. Issue the certificate; on a properly configured host this typically completes automatically within a few minutes.
  4. Confirm auto-renewal is active — Let's Encrypt certificates are valid for 90 days and require automatic renewal; a host that doesn't handle this automatically will eventually let the certificate lapse, triggering a scary browser security warning for visitors.

Force HTTPS Sitewide, Not Just on Some Pages

Having a valid certificate installed doesn't automatically mean every page loads over HTTPS — a site can still be reachable over plain HTTP alongside HTTPS unless redirection is explicitly configured. Adding an HTTPS redirect rule (via .htaccess, or a plugin-level setting on WordPress) ensures every visitor, regardless of which URL they arrive at, ends up on the secure version, and prevents search engines from indexing both an HTTP and HTTPS version as separate, duplicate pages.

The Real Cause of the "Not Fully Secure" Warning

This is where most SSL setups quietly go wrong. Even with a valid, correctly installed certificate, a browser will show a "not fully secure" or broken-padlock warning if the page loads ANY resource — an image, a script, a stylesheet — over plain HTTP instead of HTTPS. This is called mixed content, and it commonly happens when a site was built or migrated before SSL was added, leaving old hardcoded http:// links scattered through the database, theme files, or page builder content.

How to Actually Find and Fix Mixed Content

  1. Open the site in Chrome, open Developer Tools (F12), and check the Console tab — mixed content warnings are typically logged explicitly there, often naming the exact offending resource URL.
  2. For WordPress specifically, a search-and-replace plugin (or a direct database search-and-replace for http://yourdomain.com to https://yourdomain.com) catches hardcoded links stored in post content, widgets, and theme options.
  3. Check for any hardcoded external resources (embedded videos, third-party widgets, old image CDN links) still pointing to an HTTP URL — these need updating individually since a bulk search-and-replace on your own domain won't catch external ones.
  4. Re-check the browser console after each fix; mixed content warnings disappear one by one as each offending resource is corrected, and the padlock only turns fully solid once none remain.

Why This Matters Beyond the Visual Warning

A partial or broken padlock is not just cosmetic — it visibly signals "not fully secure" to visitors in the address bar, which is exactly the kind of trust signal a business selling anything or collecting any customer data cannot afford to get wrong. It also affects SEO indirectly, since Google has treated HTTPS as a ranking signal for years and can flag sites with unresolved mixed content issues during crawling.

A Quick Pre-Launch Checklist

  • Certificate installed and covering both root domain and www
  • Auto-renewal confirmed active, not manual
  • Sitewide HTTP-to-HTTPS redirect in place
  • Browser console checked on every major page template for mixed-content warnings
  • Any third-party embeds and external resource links verified as HTTPS

Free SSL removes the cost barrier entirely, but a genuinely secure-looking site still requires this second pass most site owners skip — the certificate is necessary, not sufficient, on its own.