Soft2Hosting
How to Install and Automate Free SSL Certificates in cPanel Shared Hosting
Soft2Hosting plans include free SSL, issued and renewed automatically by cPanel's AutoSSL. Your job is to confirm every domain and subdomain is covered, fix any validation failures, then force HTTPS and clean up mixed content. This guide walks through each step.
Step 1: check coverage
Open SSL/TLS Status in cPanel. It lists each domain and subdomain with its certificate status. Tick any that are not covered and choose Run AutoSSL. The cPanel documentation explains each status and what AutoSSL checks.
Step 2: fix validation failures
Certificate authorities must confirm you control the domain before issuing a certificate. Let's Encrypt, for example, documents its challenge types, and the HTTP and DNS checks depend on your domain pointing at the right place. Common causes of failure:
- DNS not pointing here yet. The domain's A record must point to your hosting account. Wait for DNS changes to propagate and run AutoSSL again.
- A CDN or proxy in front. Some proxy settings block validation. Check your CDN's SSL mode or temporarily bypass it.
- Redirect rules. An
.htaccessrule that redirects every request can block the validation file. Exclude the.well-knownpath. - Unused subdomains. Subdomains such as
mail.orcpanel.that do not resolve fail validation. Point them correctly or exclude them.
Step 3: force HTTPS
Once every name shows a valid certificate:
- In cPanel's Domains page, turn on Force HTTPS Redirect for each domain.
- In WordPress, set both the WordPress Address and Site Address to https URLs.
Step 4: fix mixed content
A page loaded over HTTPS that pulls images, scripts or styles over HTTP shows a warning or broken padlock. Search your content and theme settings for http:// links to your own domain and update them. WordPress's migration documentation explains safe ways to replace old URLs in the database without breaking serialised data.
Verify
- Visit the site with
http://and confirm it redirects tohttps://. - Check the padlock on the home page and a few inner pages.
- Open the browser's developer console and confirm there are no mixed-content warnings.
- Check the certificate expiry date. AutoSSL renews it automatically before it expires.
Plans
| Plan (billed yearly) | Websites | NVMe storage | Backups | Extras | Price | |
|---|---|---|---|---|---|---|
| Starter Pro | 1 | 10 GB | 5 accounts | Weekly | Free auto SSL, 5 databases, 100 GB bandwidth | ₹2,499 |
| Business Pro Hosting | 10 | 50 GB | Unlimited | Daily | LiteSpeed + cache, basic DDoS protection, unmetered bandwidth | ₹4,999 |
| Enterprise Pro Hosting | Unlimited | 100 GB | Unlimited | Daily backup + restore | LiteSpeed + Redis cache, advanced DDoS protection, priority support | ₹7,999 |
Prices are annual in INR, as listed on the Soft2Hosting cPanel plans page. Taxes and final terms are confirmed at checkout. Every plan includes cPanel access and free SSL.
Subdomains and addon domains
Every name visitors use needs a certificate: the bare domain, the www version, and any subdomains such as shop or blog. Addon domains on Business Pro Hosting and Enterprise Pro Hosting are covered the same way, as long as each one points at your account. After adding a new domain or subdomain, check SSL/TLS Status again, because AutoSSL can only issue a certificate once DNS for that name resolves to your hosting.
When to review
- After any DNS change or move to a CDN.
- After adding a new domain, addon domain or subdomain.
- If a browser ever shows a certificate warning. Do not tell visitors to click through it. Fix it.
HTTPS for forms and logins
Any page that collects personal details, a password or payment information must load over HTTPS. Browsers now mark such forms on plain HTTP as not secure, and many visitors will stop there. Once Force HTTPS Redirect is on, every page, including forms, is served securely. If you embed third-party widgets such as maps, booking tools or chat, make sure they also load over HTTPS, or they will trigger mixed-content warnings.
Frequently asked questions
Is free SSL as secure as a paid certificate?
For encrypting traffic, yes. Domain-validated certificates provide the same encryption. Paid certificates add organisation validation or warranties, which some businesses want for other reasons.
Do I need to renew it?
No. AutoSSL renews certificates automatically as long as the domain keeps pointing to your account.
Does SSL affect search rankings?
HTTPS is a basic expectation for modern sites, and browsers warn visitors about sites without it. Treat it as required.
What about email SSL?
Use the secure mail ports shown in cPanel's Connect Devices page so mail apps also connect over encrypted connections.