How to Get a Free SSL Certificate for Your Website
You almost certainly do not need to buy an SSL certificate. Most hosts and website builders include a free one — the job is switching it on, making sure it renews, and sending every visitor to the https version.
Common signs of this issue
- Browsers show "Not secure" next to your web address, or there is no padlock at all.
- Your site only loads as http://, or https:// shows a privacy warning instead of your pages.
- Your host or a web company is trying to sell you an SSL certificate for a yearly fee and you are not sure you need it.
- You just moved to a new host or pointed your domain somewhere new and the padlock disappeared.
- Your certificate keeps expiring and someone has to remember to renew it by hand.
- A form, checkout, or login page on your site warns visitors that information is not sent securely.
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Find out what you already have. In your hosting dashboard look for a section called SSL/TLS, SSL/TLS Status, AutoSSL, Let's Encrypt, or SSL It! (Plesk). On most shared hosting a free certificate is included and may only need switching on for your domain.
- If you use cPanel, open SSL/TLS Status. It lists your domain and its www and mail versions with a green, yellow, or red marker, and has a Run AutoSSL button. A red marker usually comes with a plain-English reason, such as the domain not pointing at this server yet.
- If your site is on Wix, Squarespace, Shopify, or a similar builder, SSL is included and switched on automatically once your domain is connected properly. If it is missing, the cause is almost always a domain connection that is not finished — not a certificate you need to buy.
- If you use Cloudflare, check SSL/TLS in your Cloudflare dashboard. Cloudflare gives visitors a free certificate, but your own server still needs one too. The recommended setting is Full (strict); "Flexible" leaves the connection between Cloudflare and your server unencrypted.
- Free certificates must point at the right server to be issued. If you changed nameservers or DNS recently, give it time to settle, then run the check again. A certificate cannot be issued for a domain that still points at your old host.
- Once the padlock appears, click it and look at the certificate details. Note the issuer (for example Let's Encrypt, Sectigo, or Google Trust Services) and the expiry date. Free certificates are short-lived on purpose — typically 90 days — and renew automatically when the setup is right.
- Make sure everyone ends up on https. Type your address with plain
http://and see whether it redirects tohttps://. If it does not, ask your host or developer to add the redirect — many dashboards have a simple "Force HTTPS" switch. - After switching, look for a broken or grey padlock on individual pages. That is usually mixed content — images or scripts still loading over http — which is a quick fix but needs doing page by page or with a tool.
What this usually means
For a normal small business website, a free certificate gives exactly the same encryption as a paid one. Visitors see the same padlock and Google treats them the same. Free certificates come from groups like Let's Encrypt, and most hosts now issue them automatically through tools like cPanel AutoSSL. What paid certificates add is mostly paperwork — organisation validation, warranties, or a support line — which rarely matters to a local business site.
The real work is not getting the certificate but keeping it renewed. Free certificates last around 90 days, and since 2026 even paid certificates have much shorter maximum lifetimes than they used to, with the limit shrinking again over the next few years. That means renewal has to be automatic. When a free certificate "suddenly expires", it is usually because automatic renewal quietly failed — often after a DNS change, a move to Cloudflare, or a domain that stopped pointing at the server.
If your host does not offer a free certificate at all in 2026, that is a signal about the host rather than a reason to pay. Almost every mainstream host includes one. Putting Cloudflare in front of the site is another free route, but it still needs a certificate on your own server to be done properly.
What not to do
- Don't pay a yearly fee for a basic certificate before checking whether your host already includes a free one.
- Don't set Cloudflare to "Flexible" as a permanent fix. It shows a padlock but leaves part of the journey unencrypted, and it often causes redirect loops on WordPress.
- Don't install a self-signed certificate on a public website. Browsers will show visitors a full-page warning.
- Don't rely on reminder emails. Let's Encrypt stopped sending expiry warning emails in 2025, so a failed renewal can go unnoticed until visitors see an error.
- Don't force https before the certificate is actually working, or visitors get sent straight into a security warning.
- Don't give certificate files or private keys to anyone who emails offering to "install your SSL". Ask your host instead.
When to get help
If your host's tools show errors you don't understand, the certificate keeps failing to renew, or your site sits behind Cloudflare and the padlock comes and goes, it is worth having your host or a developer sort it out. Your host's support team can usually issue and renew a free certificate for you, often in a single support ticket. Bring in a developer if the certificate works but parts of the site break after switching to https — mixed content, redirect loops, or old http links baked into the site are quick for someone experienced and fiddly for anyone else.
Could your hosting be the problem?
If your host is slow, unreliable, or hard to deal with, moving to a better one can clear up issues like this for good. One we genuinely recommend is Instant Access Internet Services — a smaller, compassionate company with 30 years in the business, known for being one of the fastest, with great management and low pricing. (Just a recommendation — no affiliate link, no kickback.)
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Is this a business website? If this issue may be costing you leads, sales, or trust, you may want a direct review instead of trial and error.
Frequently asked questions
Is a free SSL certificate as secure as a paid one?
Yes for encryption. A free Let's Encrypt or AutoSSL certificate uses the same strength of encryption and shows the same padlock as a basic paid certificate. Paid options mainly add identity checks on your organisation, warranties, and support.
How long does a free SSL certificate last?
Usually 90 days. That is deliberate: short certificates are safer, and your host or tool renews them automatically before they expire. You should not have to do anything by hand.
Does Google rank sites with paid SSL higher?
No. Google uses https as a small ranking signal, but it does not care whether the certificate was free or paid.
My host charges for SSL. What can I do?
Ask whether they offer a free Let's Encrypt or AutoSSL option, since most do. If they genuinely don't, you can put Cloudflare in front of the site for free, or consider whether a host that charges for basic SSL in 2026 is the right host.
Do I need a separate certificate for www and non-www?
The certificate needs to cover both names, but one certificate can do that. AutoSSL and most host tools include both automatically as long as both versions of the domain point at the server.
Why did my free certificate stop working?
Most often the automatic renewal failed because the domain no longer pointed at the server, Cloudflare or a firewall blocked the check, or the site was moved. Your host's SSL status page usually says which.