Do I have to pay for SSL?

No. A free SSL certificate that browsers fully trust is included with every shared, WordPress and reseller plan, and it renews automatically. Paid certificates exist for specific business needs (like organisation validation), but for the vast majority of sites the free certificate is all you need.

How long does SSL take to activate?

Usually under an hour once your domain is pointing at the server. It can't be issued until the domain resolves to us, so if you've just changed nameservers, wait for that to propagate first, then run AutoSSL if it hasn't appeared on its own.

All guidescPanel

How to Install a Free SSL Certificate (HTTPS) in cPanel

Updated 20 July 20265 min read

Free SSL is included with every plan and is issued automatically once your domain points at the server — usually within an hour. To confirm it, open SSL/TLS Status in cPanel and check your domain shows a valid certificate. If it hasn't issued yet, run AutoSSL from that same screen. Once it's active, load your site over https:// and force the redirect so every visitor gets the padlock.

Check and turn on SSL

1In cPanel, open Security → SSL/TLS Status.
2Find your domain in the list. A green padlock means the certificate is active.
3If it's not active yet, tick your domain and click Run AutoSSL. Give it a few minutes to complete.
4Visit https://yourdomain.com and confirm the padlock appears in the browser bar.

Force the whole site onto HTTPS

Having a certificate isn't enough — you also want every visitor pushed to the secure version. For WordPress, set both the WordPress Address and Site Address (Settings → General) to the https:// version, then use a plugin or your caching tool's 'force HTTPS' option. For other sites, add a redirect rule to your .htaccess file so http:// requests are sent to https://.

If the padlock still shows a warning

Mixed content: an image, script or stylesheet is still loading over http://. Update those links to https:// (a plugin can do this in bulk for WordPress).
Certificate not issued yet: if your domain only just started pointing at the server, wait for DNS to finish, then run AutoSSL again.
Cached page: clear your browser and site cache after enabling SSL so you're not seeing an old insecure version.