Free SSL on Shared Hosting: From Certificate to Clean Padlock

Browsers now shame every plain-HTTP site with a Not Secure label, and search engines quietly agree. The good news: on decent shared hosting, SSL certificates are free, automatic and self-renewing. The remaining work, forcing HTTPS and cleaning mixed content, takes an evening and this guide.

How your free certificate happens

Modern cPanel hosts (WebsNP included) run AutoSSL: the server proves to a certificate authority that it controls your domain, receives a certificate, installs it, and repeats before every expiry. Your involvement is zero, with one condition: your domain's DNS must actually point at the server, since that is what gets validated. New domain showing no certificate? Check DNS, wait for propagation, done.

Step 1: Confirm the certificate exists

cPanel's SSL/TLS Status page lists your domains with green locks or red warnings. Green means the certificate side is finished. Red almost always means DNS points elsewhere, or an expired domain, or a dead subdomain you can exclude.

Step 2: Force HTTPS everywhere

A certificate does not redirect visitors; http:// still answers unless you send it to https://. Three routes, use one:

• cPanel: many hosts show a Force HTTPS toggle per domain in the Domains screen. Easiest.
• WordPress: update both address fields in Settings, General to https://, or let an SSL plugin handle everything including the next section.
• .htaccess: the classic rewrite rule pair at the top of the file, for non-WordPress sites and control enthusiasts.

Step 3: Hunt the mixed content

Mixed content means an https:// page loading some resource over http://: an old hardcoded image URL, a theme's font call, a widget from 2019. Browsers respond by breaking your padlock or blocking the resource. The hunt:

1. Open the site, press F12, read the Console: every mixed-content item is listed with its URL.
2. On WordPress, a search-replace of http://yourdomain.com to https://yourdomain.com in the database clears the bulk (SSL plugins do this safely).
3. Whatever remains is hardcoded in the theme or widgets: search the theme files, or replace the offending embed. Third-party resources with no https version simply need to go; anything still http-only in 2026 was not worth embedding.

Renewals: what could possibly go wrong

AutoSSL renews unattended forever, with two classic exceptions: the domain expired (renew it, everything self-heals), or DNS moved away mid-lifecycle. If a previously green site warns of expiry, those two checks solve it in minutes. There is no calendar to keep, no invoice to pay; certificates as a chore are simply over.

The after-photo

Clean padlock on every page, http:// visitors seamlessly redirected, and the Not Secure label on your competitors' sites doing your marketing for you. Total spend: zero. If any step above disagrees with what you see in your cPanel, our support fixes SSL issues daily and would rather you ask than struggle.