How to Install Free SSL on WordPress

Every NexzaHost plan includes unlimited free Let's Encrypt certificates through AutoSSL, covering your domain and all its subdomains, renewed automatically. HTTPS is not optional any more: browsers mark plain HTTP as "Not secure", and Google has used HTTPS as a ranking signal since 2014.

Step 1 — Confirm DNS points here

AutoSSL proves you control the domain by checking it resolves to our server. If DNS has not propagated, issuance fails with a validation error that looks alarming but only means "not yet". Confirm the domain resolves to your NexzaHost IP before continuing.

Step 2 — Run AutoSSL

In cPanel, open Security > SSL/TLS Status. Tick your domain, www, and any subdomains, then click Run AutoSSL. Issuance usually completes in a minute or two, and the status column turns green when the certificate is installed.

Step 3 — Move WordPress itself to HTTPS

A certificate on the server does not by itself change what WordPress thinks its address is.

In Settings > General, change both WordPress Address (URL) and Site Address (URL) from http:// to https://, then save. You will be logged out — that is expected. Log back in over https://.

If you cannot reach the admin area to make this change, add these two lines to wp-config.php instead, above the line that reads /* That's all, stop editing! */:

define('WP_HOME','https://yourdomain.com');
define('WP_SITEURL','https://yourdomain.com');

Step 4 — Force HTTPS for every visitor

So that anyone arriving on http:// is moved across, add this to the very top of your .htaccess file in public_html:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

A 301 here matters: it tells search engines the HTTPS version is the permanent one, so ranking signals consolidate onto it rather than splitting across two versions of the site.

Step 5 — Fix mixed content

If the padlock does not appear even though the certificate is valid, something on the page is still loading over http:// — usually an image path saved into the database when the site was built.

• Open the browser console and look for "Mixed Content" warnings; they name the exact offending file.
• Update hardcoded http:// URLs in your theme files and widgets.
• For URLs stored in posts and pages, a search-replace plugin will rewrite http://yourdomain.com to https://yourdomain.com across the database in one pass. Take a backup first.
• Re-save permalinks under Settings > Permalinks afterwards.

Renewal

AutoSSL renews certificates automatically before they expire, so there is nothing to diary. Renewal only fails if the domain stops resolving to our server — for instance if nameservers are changed and the old ones are left in place. If you ever get an expiry warning, check DNS first.

Still not working

• "Your connection is not private" on `www` only. The certificate did not include the www subdomain. Re-run AutoSSL with www selected.
• Redirect loop after adding the .htaccess rule. Usually a Cloudflare SSL mode conflict. Set Cloudflare's SSL/TLS mode to Full (strict) rather than Flexible.
• Certificate issued but the site still serves HTTP. The two URLs in Settings > General were not updated, or a caching plugin is serving an old copy. Clear the cache.