Installing a free SSL certificate (and fixing the padlock)

It is usually already done

Every hosting plan includes free AutoSSL. Within an hour of your domain pointing at us, a certificate is issued and renewed automatically forever. Check it under cPanel → Security → SSL/TLS Status.

Forcing HTTPS

A certificate alone does not redirect visitors. In cPanel, Domains → Force HTTPS Redirect — one toggle.

For WordPress, also set both WordPress Address and Site Address to https:// under Settings → General.

"Not secure" even though the certificate is installed

This is nearly always mixed content: the page is served over HTTPS but pulls an image, script or stylesheet over plain HTTP.

1. Open the browser console (F12) and read the mixed-content warnings — they name the exact file.
2. In WordPress, a search-and-replace plugin fixes old http:// URLs in the database in one pass.
3. Hard-refresh with Ctrl+Shift+R; browsers cache the insecure version aggressively.

AutoSSL did not issue a certificate

The three usual causes:

• The domain does not point at our server yet. AutoSSL validates over HTTP and cannot verify a domain it does not serve.
• A .htaccess redirect is blocking /.well-known/. Allow that path.
• The domain is behind Cloudflare in proxy mode. Either use Cloudflare's own certificate or set the record to DNS-only while AutoSSL runs.

If none of those apply, open a ticket — we can trigger AutoSSL manually and read the exact failure reason from the server log.