How to enable free SSL in cPanel

The SSL certificate is what makes the browser show the padlock and the address start with https://. Without it, Chrome marks the site as "Not secure" right next to the address — and Google uses HTTPS as a ranking signal. At RedHosting the certificate is free on every hosting plan.

1. Most of the time it's already active

The hosting issues the certificate on its own, through AutoSSL, as soon as the domain starts pointing to the server. Before anything else, check:

• Log in to cPanel and, under Security, click SSL/TLS Status.
• The list shows each domain and subdomain on the account. A green padlock means the certificate is issued and valid.

If everything is green, skip to step 3.

2. Issuing the certificate manually

If any domain shows up without a certificate:

• On the same SSL/TLS Status screen, check the box for the missing domains.
• Click Run AutoSSL.
• Wait a few minutes and reload the page.

3. Forcing the site to open over HTTPS

An issued certificate doesn't redirect by itself: the site keeps opening over http:// for anyone who types it that way. cPanel fixes this with one toggle:

• Under Domains, click Domains.
• Turn on the Force HTTPS Redirect toggle for the domain.

If you'd rather do it in .htaccess, at the top of the file in public_html:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

4. When the padlock stays broken

The certificate is valid, but the browser shows the padlock with a warning. That's mixed content: the page opened over HTTPS and is loading some image, CSS or script over HTTP.

To find the culprit, open the page, press F12 and check the Console tab — the browser lists every insecure resource.

On a WordPress site, the fix is usually:

• Under Settings → General, change the WordPress Address and Site Address to https://.
• Run a search-and-replace plugin swapping http://yourdomain for https://yourdomain in the database. Old addresses stay stored in posts and don't change by themselves.

On a hand-built site, search for http:// in the HTML and CSS and replace it with a relative path — /images/photo.png instead of the full address.

5. Renewal

AutoSSL renews on its own before expiry, with nothing for you to do. Renewal only fails if the domain stops pointing to the hosting — in that case cPanel warns you by email.

6. After SSL

• Update the site address in Google Search Console to the https:// version.
• Check internal links and the sitemap, which may still use http://.
• If you have email on the domain, the certificate also covers mail.yourdomain.com — it's worth reconfiguring your phone to use SSL/TLS.

Need help?

Open a ticket at financeiro.redhosting.com.br or contact support on WhatsApp at +55 11 98833-3902.