Install free SSL in cPanel and force HTTPS

Step 1: Check SSL/TLS Status and run AutoSSL

AutoSSL runs once a day on its own: it requests, installs and renews a certificate for every name in your account that points to the server. You only need to confirm it worked, or nudge it right after changing DNS.

1. Open SSL/TLS Status

   Go to cPanelSecuritySSL/TLS Status. Every name in your account is listed, including the service subdomains cPanel creates for you (mail., webmail., cpanel. and others).

   cPanel›Security›SSL/TLS Status

   SSL/TLS StatusAutoSSL is on

   DomainExpiresCertificate status

   yourdomain.in12 May 2027AutoSSL Domain Validated

   www.yourdomain.in12 May 2027AutoSSL Domain Validated

   shop.yourdomain.in—Self-signed: not trusted

   mail.yourdomain.in12 May 2027AutoSSL Domain Validated

   Run AutoSSLExclude Domains from AutoSSL

2. Click Run AutoSSL

   Use this if a name shows no certificate, a self-signed one or an error, or if you've only just pointed the domain at us. The check takes a minute or two for a small account. Leave the page open, then reload it when it finishes.

3. Read the result for each name

   Green means issued and installed. If a name still fails, expand its status to see why; usually that name doesn't resolve to our server yet. The next section covers every requirement.

   Don't need a name covered? Untick it and click Exclude Domains from AutoSSL. This is useful for a subdomain whose DNS lives elsewhere, which would otherwise show a failed check every day.

What AutoSSL needs before it can issue

The certificate authority must be able to confirm the domain is yours. It does that by fetching a small file from the website (HTTP validation) or reading a DNS record (DNS validation, when your nameservers are ours). Each item below breaks that check; during a free migration from your old host, the first one applies until DNS is switched.

From a terminal, the same checks take ten seconds:

# Both names must return your server's IP
dig +short A yourdomain.in @1.1.1.1
dig +short A www.yourdomain.in @1.1.1.1

# Empty output is fine. If records come back, the issuing CA must be listed
dig +short CAA yourdomain.in

If you do publish CAA records, for example because a security audit asked for them, they must name every authority that issues for you, or AutoSSL is refused. AutoSSL uses Let's Encrypt or Sectigo depending on the server, so listing both is the safe choice:

yourdomain.in.  3600  IN  CAA  0 issue "letsencrypt.org"
yourdomain.in.  3600  IN  CAA  0 issue "sectigo.com"

Step 2: Send every visitor to HTTPS

A certificate only protects visitors who arrive on https://. Old links, bookmarks and people typing the bare domain still land on http:// until you add a permanent (301) redirect. Use one of these two methods, not both.

cPanel›Domains›Domains

DomainForce HTTPSDocument root

yourdomain.inOn/public_html

shop.yourdomain.inOff/shop.yourdomain.in

For option B, put this block at the very top of .htaccess, above any # BEGIN WordPress section. It leaves /.well-known/ alone, so renewals keep validating:

# Redirect all HTTP traffic to HTTPS (301)
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/\.well-known/
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Want one canonical address as well? This version sends http://, http://www. and https://www. straight to https://yourdomain.in in a single hop. Use it in place of the block above, not alongside it:

# HTTPS and no-www in one redirect
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/\.well-known/
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

Step 3: Switch WordPress to its https:// address

WordPress stores its own address and builds every link from it, so a redirect alone leaves it generating http:// links. Change the address once, then update the links already saved in your posts.

1. Change both addresses in Settings

   In WordPressSettingsGeneral, change WordPress Address (URL) and Site Address (URL) to https://yourdomain.in and save. You'll be logged out once; log back in on the new address. If both fields are greyed out, they're fixed in wp-config.php. Edit them there instead:

   define( 'WP_HOME', 'https://yourdomain.in' );
   define( 'WP_SITEURL', 'https://yourdomain.in' );

2. Update links stored in your content

   Images and internal links in older posts still contain http://. With SSH access, WP-CLI rewrites them safely, including inside serialised data. Run it from the site's folder and check the dry run first:

   # Preview: shows how many replacements each table would get
   wp search-replace 'http://yourdomain.in' 'https://yourdomain.in' \
     --skip-columns=guid --dry-run
   # Apply, then clear caches
   wp search-replace 'http://yourdomain.in' 'https://yourdomain.in' \
     --skip-columns=guid
   wp cache flush

   No SSH? A search-and-replace plugin does the same job from wp-admin. Never run a plain SQL REPLACE on WordPress tables, because it corrupts serialised settings.

3. Purge the page cache

   Cached pages still hold the old links. In LiteSpeed CacheToolboxPurge, click Purge All, then load the site in a private window.

Clear mixed-content warnings

If the page loads over HTTPS but the padlock is missing or crossed out, something on the page is still requested over http://: an image, a font, a script or a stylesheet. Browsers block insecure scripts outright and flag the rest.

1. Find the culprits

   Open the page, press F12 (or Cmd + Option + I on a Mac) and look in the Console tab for lines starting with Mixed Content. Each line names the exact URL.

2. Fix them where they live

   Usual hiding places are theme options (logo and background images), custom HTML or footer widgets, hard-coded URLs in a child theme's CSS, and third-party embed codes copied years ago. Change each one to https://. If the third party doesn't offer HTTPS, replace the embed.

3. Use a safety net while you clean up

   This header asks browsers to upgrade any leftover http:// requests on your pages. Add it to .htaccess. It hides the symptom, so still fix the source URLs:

   <IfModule mod_headers.c>
   Header always set Content-Security-Policy "upgrade-insecure-requests"
   </IfModule>

Renewals, and when a paid certificate makes sense

Public certificates are getting shorter by industry rule (CA/Browser Forum ballot SC-081): at most 200 days from 15 March 2026, 100 days from March 2027 and 47 days from March 2029. With AutoSSL that changes nothing for you. It checks daily and renews well before expiry, as long as the domain keeps pointing to our server and nothing blocks /.well-known/.

The free certificate encrypts traffic exactly as well as a paid one. Pay only when you need something AutoSSL doesn't give you:

Paid certificates are bought as 1–3 year subscriptions with free reissues during the term. See SSL certificates for what each type covers.

AutoSSL troubleshooting