Free SSL: what it does and does not do
HTTPS is table stakes now. Here is what it actually protects, and the three mistakes that break it.
Every plan here includes free SSL certificates, issued and renewed automatically. It is worth understanding what that buys you.
What it does
It encrypts traffic between your visitor and our server, so nobody on the same café Wi-Fi can read the form your customer just submitted or tamper with the page on its way to them. It also proves the visitor reached your server and not an impostor.
What it does not do
It does not make your site secure. An out-of-date plugin, a weak password or an SQL injection flaw are all just as exploitable over HTTPS. The padlock is about the connection, not the application.
Three things that break it
- Mixed content. One image or script loaded over
http://and the padlock disappears. Search your database for hard-coded http URLs after switching. - No redirect. If both http and https work, half your traffic stays unencrypted and search engines see duplicate URLs. Force the redirect.
- An expired certificate. Ours renew automatically, but if you have installed a third-party certificate manually, put the expiry in your calendar.
Do it today
Enable SSL in cPanel, update your site URL to https, fix any mixed content, then force the redirect. Half an hour, and it is done for good.