How to set up a free SSL certificate

SSL is not optional any more. Browsers mark plain http:// pages as 'Not secure' in the address bar, forms on unencrypted pages trigger warnings, and Google has used HTTPS as a ranking signal for years. A certificate costs nothing here and takes about five minutes.

HostPowr issues free Let's Encrypt certificates through AutoSSL on every hosting plan, and renews them automatically every 90 days. There is nothing to buy and no renewal date to diarise.

Before you start

• The domain must already resolve to your HostPowr account. Certificate validation works by fetching a file from your site, so a domain that has not finished propagating cannot be validated.
• Both yourdomain.com and www.yourdomain.com should exist in cPanel if you want both covered.

Steps

1. In cPanel, open SSL/TLS Status.
2. Select the domains you want to secure, including the www variant.
3. Click Run AutoSSL.
4. Wait for validation. It usually completes in under five minutes.
5. Once the certificate shows as issued, go to Domains and switch on Force HTTPS Redirect for the domain.

Check that it worked

• Open your site with http:// and confirm the browser lands on https:// instead.
• Check for a padlock in the address bar with no warning beside it.
• Click the padlock and confirm the certificate covers the exact hostname you are visiting, including www if that is how people reach you.

If it goes wrong

AutoSSL fails validation

The usual cause is DNS: the domain does not yet resolve to this server, so Let's Encrypt cannot fetch the validation file. The second most common cause is a redirect or a firewall rule blocking /.well-known/ — that path must stay reachable over plain http.

Padlock shows but with a warning

The page is loading some resources over http — usually an image, a font or a script with a hardcoded http:// URL. On WordPress, a search-and-replace plugin fixes it across the database in one pass.

The certificate covers the domain but not www

Add the www subdomain in cPanel and run AutoSSL again. A certificate only covers the exact hostnames it was issued for, and www.yourdomain.com is a different hostname from yourdomain.com.

Renewal is automatic and happens roughly 30 days before expiry. The one thing that breaks it is removing the domain from cPanel or changing where it points, so if you move a domain away, expect the certificate to lapse.

For a site handling payments or logins, force HTTPS at the application level as well as in cPanel. WordPress, for example, should have both its address settings on https:// so it never generates an insecure link in the first place.