How to Install an SSL Certificate on Your Website
That small padlock beside your address tells visitors their connection is encrypted, and browsers now warn people loudly when it is missing. If you need to install an SSL certificate, the good news is that it is usually a few clicks on modern hosting. This guide explains what SSL/TLS does, the types of certificate available, the installation routes for typical setups, and how to fix the problems that often follow.
What SSL (TLS) does
SSL is the old name; the technology in use today is TLS, but everyone still says SSL. A certificate does two jobs:
- Encryption: it scrambles data travelling between the browser and your server, so passwords and form entries cannot easily be read by someone intercepting the connection.
- Identity: it helps confirm that the site really belongs to the domain shown.
A site with a valid certificate loads at an address starting with https:// rather than http://. If you collect any personal information, such as contact forms or logins, HTTPS is expected practice and supports your obligations under UK data protection law to keep personal data secure. This is general information rather than legal advice.
Types of certificate
| Type | What it validates | Typical use |
|---|---|---|
| Domain Validated (DV) | You control the domain | Most blogs, small business sites, many shops |
| Organisation Validated (OV) | The organisation is a real entity | Businesses wanting extra verified details |
| Extended Validation (EV) | A stricter organisation check | Larger organisations, though browsers no longer highlight it prominently |
Most small sites are well served by a DV certificate, and free options such as those issued by Let’s Encrypt provide the same level of encryption as paid DV certificates. Paid certificates may add support, warranties or validation levels. Check what your host includes before spending anything.
You may also see “wildcard” certificates, which cover a domain and all its subdomains, and “multi-domain” certificates, which cover several different names in one.
Before you begin
- Make sure your domain already points to your hosting. Certificate authorities need to verify you control it. See our guide on how to point a domain to your web host if you have not done this.
- Confirm that your site loads over plain http first.
- Take a backup. Changing site addresses can occasionally cause trouble, and our WordPress backup guide shows how.
Route 1: Use your host’s automatic SSL
The easiest path. Many hosts issue and renew free certificates automatically.
- Log in to your hosting control panel.
- Look for a section named “SSL/TLS”, “Security” or “Let’s Encrypt”.
- Find your domain and choose to issue or enable the certificate.
- Wait a few minutes, then visit https://yourdomain.co.uk.
If the option is already on, you may not need to do anything. In that case, move straight to forcing HTTPS below.
In cPanel
Many UK hosts use cPanel. A typical sequence is to open “SSL/TLS Status”, select the domain names (including the www version), and run the automatic certificate check. When it completes, the status shows a padlock. If you see an error, the most common cause is DNS that has not finished propagating.
Route 2: Install a purchased or third-party certificate
If you bought a certificate separately, the process looks like this:
- Generate a CSR (Certificate Signing Request). Your control panel can do this; it creates a private key and a request containing your domain details. Keep the private key secure and do not share it.
- Submit the CSR to the certificate authority when you order.
- Complete validation. For DV this is done by email, a DNS record or uploading a small file to your site.
- Download the certificate files. You will usually receive the certificate itself and an intermediate (CA bundle) file.
- Install them in the SSL/TLS section of your control panel by pasting the certificate and the CA bundle into the matching boxes.
- Test the site over HTTPS.
Certificates expire, so note the renewal date. Paid certificates are typically valid for a limited term, and free ones renew more frequently, ideally automatically.
Route 3: Use a CDN or website builder
Content delivery networks and hosted website builders often provide SSL as part of the service. Look for a setting called “SSL”, “HTTPS” or “Always use HTTPS”. With a CDN in front of your server, pay attention to the encryption mode: the safest setting encrypts traffic all the way to your origin server as well as between the visitor and the CDN.
Forcing HTTPS on WordPress
Installing the certificate makes HTTPS available, but visitors can still arrive on the http version. To send everyone to the secure address:
- In WordPress, go to Settings and General. Change both the WordPress Address and the Site Address from http:// to https://, then save. (Do this only after confirming the certificate works, or you could lock yourself out.)
- Add a redirect so the old addresses forward to the new ones. Hosts often have a “Force HTTPS” toggle. Otherwise, a redirect rule in the.htaccess file on Apache servers does the job; your host’s documentation will give the correct snippet for your set-up.
- Update internal links, images and embedded resources that still use http.
- Clear any caching plugin and your CDN cache.
A search-and-replace plugin or tool can update old http links in the database. Always back up first.
Fixing mixed content
Mixed content happens when the page loads over HTTPS but some resources, like images or scripts, still load over HTTP. Browsers may then drop the padlock or show a warning.
To find it:
- Open your browser’s developer tools and check the Console tab for “mixed content” messages.
- View the page source and search for “http://”.
To fix it:
- Change the links to https:// or to relative paths.
- Update hard-coded URLs in your theme or widgets.
- Replace any third-party resource that does not support HTTPS.
Common errors and what they mean
| Browser message | Probable cause | Fix |
|---|---|---|
| Certificate not valid for this name | Certificate covers a different domain or lacks www | Reissue including both versions |
| Certificate expired | Auto-renewal failed or lapsed | Renew or reissue; check DNS and file permissions |
| Not secure despite HTTPS | Mixed content | Update insecure resources |
| Too many redirects | Conflicting redirect rules or CDN settings | Remove duplicate redirects; check encryption mode |
| Self-signed certificate | Default server certificate in use | Install a proper certificate |
After installation
- Test the site in several browsers and on mobile.
- Check that forms and logins work.
- Update the address in Google Search Console and your analytics.
- Add a reminder to review certificate status quarterly, even if renewal is automatic.
- Keep an eye on the host’s notification emails about renewal failures.
How to Back Up a WordPress Site Properly
FAQs
Is a free SSL certificate as secure as a paid one?
For encryption, a free DV certificate offers comparable protection to a paid DV one. Paid products may add extra validation, support or insurance-style warranties, which matter more to larger organisations.
Does SSL affect SEO?
HTTPS is a lightweight ranking signal and an expectation of visitors. It will not transform your rankings by itself, but missing it can cost trust and traffic.
Why does my site say “Not secure” after installing SSL?
Usually mixed content or visiting the http address. Force HTTPS and update insecure resources.
How often do I need to renew?
Certificates expire after a set period. Automatic renewal handles it for most hosting set-ups, but verify that it is working.
Conclusion
To install an SSL certificate, start with whatever your host provides, force HTTPS, fix mixed content and confirm that renewal is automatic. It takes little time, and it protects your visitors and your reputation.