> ## Content Index > Fetch the complete content index at: https://soft2hosting.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Install and Automate Free SSL Certificates in cPanel Shared Hosting - URL: https://soft2hosting.com/blog/install-free-ssl-certificate-cpanel-shared-hosting/ - Published: 2026-09-26T12:12:00.000Z - Updated: 2026-09-28T11:00:57.000Z - Description: Free SSL is included. How to confirm it, fix it when it fails, and force HTTPS properly. - Author: Aniket Joshi - Tags: Soft2Hosting, Shared Hosting, SSL Certificate, cPanel AutoSSL, Website Security, HTTPS Guide Soft2Hosting plans include free SSL, issued and renewed automatically by cPanel's AutoSSL. Your job is to confirm every domain and subdomain is covered, fix any validation failures, then force HTTPS and clean up mixed content. This guide walks through each step. ## Step 1: check coverage Open SSL/TLS Status in cPanel. It lists each domain and subdomain with its certificate status. Tick any that are not covered and choose Run AutoSSL. The cPanel documentation explains each status and what AutoSSL checks. ## Step 2: fix validation failures Certificate authorities must confirm you control the domain before issuing a certificate. Let's Encrypt, for example, documents its challenge types, and the HTTP and DNS checks depend on your domain pointing at the right place. Common causes of failure: - **DNS not pointing here yet.** The domain's A record must point to your hosting account. Wait for DNS changes to propagate and run AutoSSL again. - **A CDN or proxy in front.** Some proxy settings block validation. Check your CDN's SSL mode or temporarily bypass it. - **Redirect rules.** An `.htaccess` rule that redirects every request can block the validation file. Exclude the `.well-known` path. - **Unused subdomains.** Subdomains such as `mail.` or `cpanel.` that do not resolve fail validation. Point them correctly or exclude them. ## Step 3: force HTTPS Once every name shows a valid certificate: 1. In cPanel's Domains page, turn on Force HTTPS Redirect for each domain. 2. In WordPress, set both the WordPress Address and Site Address to https URLs. ## Step 4: fix mixed content A page loaded over HTTPS that pulls images, scripts or styles over HTTP shows a warning or broken padlock. Search your content and theme settings for `http://` links to your own domain and update them. WordPress's migration documentation explains safe ways to replace old URLs in the database without breaking serialised data. ## Verify 1. Visit the site with `http://` and confirm it redirects to `https://`. 2. Check the padlock on the home page and a few inner pages. 3. Open the browser's developer console and confirm there are no mixed-content warnings. 4. Check the certificate expiry date. AutoSSL renews it automatically before it expires. ## Plans | Plan (billed yearly) | Websites | NVMe storage | Email | Backups | Extras | Price | | ---------------------- | --------- | ------------ | ---------- | ---------------------- | ------------------------------------------------------------------- | ------ | | Starter Pro | 1 | 10 GB | 5 accounts | Weekly | Free auto SSL, 5 databases, 100 GB bandwidth | ₹2,499 | | Business Pro Hosting | 10 | 50 GB | Unlimited | Daily | LiteSpeed + cache, basic DDoS protection, unmetered bandwidth | ₹4,999 | | Enterprise Pro Hosting | Unlimited | 100 GB | Unlimited | Daily backup + restore | LiteSpeed + Redis cache, advanced DDoS protection, priority support | ₹7,999 | Prices are annual in INR, as listed on the [Soft2Hosting cPanel plans](https://soft2hosting.com/web-hosting/) page. Taxes and final terms are confirmed at checkout. Every plan includes cPanel access and free SSL. ## Subdomains and addon domains Every name visitors use needs a certificate: the bare domain, the www version, and any subdomains such as shop or blog. Addon domains on Business Pro Hosting and Enterprise Pro Hosting are covered the same way, as long as each one points at your account. After adding a new domain or subdomain, check SSL/TLS Status again, because AutoSSL can only issue a certificate once DNS for that name resolves to your hosting. ## When to review - After any DNS change or move to a CDN. - After adding a new domain, addon domain or subdomain. - If a browser ever shows a certificate warning. Do not tell visitors to click through it. Fix it. ## HTTPS for forms and logins Any page that collects personal details, a password or payment information must load over HTTPS. Browsers now mark such forms on plain HTTP as not secure, and many visitors will stop there. Once Force HTTPS Redirect is on, every page, including forms, is served securely. If you embed third-party widgets such as maps, booking tools or chat, make sure they also load over HTTPS, or they will trigger mixed-content warnings. ## Frequently asked questions ### Is free SSL as secure as a paid certificate? For encrypting traffic, yes. Domain-validated certificates provide the same encryption. Paid certificates add organisation validation or warranties, which some businesses want for other reasons. ### Do I need to renew it? No. AutoSSL renews certificates automatically as long as the domain keeps pointing to your account. ### Does SSL affect search rankings? HTTPS is a basic expectation for modern sites, and browsers warn visitors about sites without it. Treat it as required. ### What about email SSL? Use the secure mail ports shown in cPanel's Connect Devices page so mail apps also connect over encrypted connections. --- ## Sources - [cPanel & WHM Documentation: SSL/TLS Status](https://docs.cpanel.net/cpanel/security/ssl-tls-status/?ref=soft2hosting.com) - [cPanel & WHM Documentation: Domains](https://docs.cpanel.net/cpanel/domains/domains/?ref=soft2hosting.com) - [Let's Encrypt: Challenge Types](https://letsencrypt.org/docs/challenge-types/?ref=soft2hosting.com) - [WordPress Advanced Administration Handbook: Migrating WordPress](https://developer.wordpress.org/advanced-administration/upgrade/migrating/?ref=soft2hosting.com)