How to Install a Free SSL Certificate in cPanel

An SSL certificate encrypts the connection between your website and your visitors, shows the padlock in the browser, and removes the “Not secure” warning that scares customers away. The good news is that most cPanel hosting accounts can get a free SSL certificate automatically. This guide explains how AutoSSL and Let’s Encrypt work in cPanel, how to check and install your certificate, and how to make your whole website load over HTTPS.

Why every website needs SSL

• Security: login details, contact form messages and payment information are encrypted while they travel over the internet.
• Trust: browsers such as Chrome mark sites without HTTPS as “Not secure”, which makes visitors hesitate.
• SEO: Google has confirmed HTTPS as a ranking signal, and it is expected on any modern website.
• Required features: many payment gateways, browser features and services work only on HTTPS sites.

There is no need to pay thousands of rupees for a basic certificate for a blog or business website. A free domain-validated (DV) certificate gives the same encryption strength as a paid DV certificate.

AutoSSL vs Let’s Encrypt vs paid SSL

AutoSSL is a cPanel feature that automatically requests, installs and renews free DV certificates for the domains in your account. The certificate itself comes from a provider chosen by your host, typically Let’s Encrypt or Sectigo. In other words, Let’s Encrypt is often the certificate authority working behind AutoSSL, not a separate thing you must set up.

Type	Cost	Validation	Renewal	Good for
AutoSSL (Let’s Encrypt or Sectigo)	Free	Domain only	Automatic	Blogs, business sites, most small shops
Let’s Encrypt via a host’s plugin	Free	Domain only	Automatic	Same as above, on hosts that use this interface
Paid DV / OV / EV certificate	Paid (₹ varies)	Domain or organisation checks	Manual or via the seller	Organisations needing verified company details or a warranty

Before you start: make sure the domain points to your hosting

Free certificates use Domain Control Validation (DCV). The certificate authority checks that your domain really points to your server, usually by loading a small test file from your website or by checking a DNS record. If your domain points elsewhere, validation fails.

• Your domain’s nameservers or A record must point to your current hosting account.
• If you changed DNS recently, wait until it has propagated.
• If you use a proxy or CDN in front of your site, validation may need extra steps; check its SSL settings.
• Rules in .htaccess that block or redirect everything can sometimes stop the validation file from loading.

How to install a free SSL with AutoSSL

1. Log in to cPanel.
2. In the Security section, click SSL/TLS Status.
3. You will see a list of your domains and subdomains, such as yourdomain.com, www.yourdomain.com, mail.yourdomain.com and cpanel.yourdomain.com, each with a status icon.
4. Click Run AutoSSL. cPanel will check every domain and request certificates for those that pass validation. This may take a few minutes.
5. Refresh the page. Domains with a green padlock and “AutoSSL Domain Validated” have an active certificate.
6. Open https://yourdomain.com in your browser and click the padlock to confirm the certificate is valid.

If the Run AutoSSL button is missing, your host may have disabled AutoSSL for your account, or it may run automatically on a schedule. In that case, contact support.

Tip: You do not need SSL on every subdomain. If a subdomain you never use fails validation, you can tick it and choose Exclude Domains from AutoSSL so it stops appearing as an error.

Using a Let’s Encrypt interface (if your host provides one)

Some hosts add a separate icon, often called Let’s Encrypt SSL or similar, in the Security section. It works in much the same way:

1. Open the Let’s Encrypt tool.
2. Find your domain in the list of domains without a certificate and click Issue.
3. Tick the extra names you want covered, such as www and mail, and choose the validation method (HTTP is the default).
4. Click Issue again. The certificate is installed automatically and renewed before it expires.

Let’s Encrypt certificates have a short validity period, typically around 90 days, but that is not a problem because renewal is automatic. Just make sure the domain keeps pointing to your server so renewal can succeed.

Installing a certificate manually

If you have bought a certificate elsewhere, or received files from another provider, you can install it yourself:

1. In cPanel, open SSL/TLS under Security.
2. If the seller needs a CSR, use Certificate Signing Requests (CSR) to generate one, along with a private key.
3. When you receive the certificate, click Manage SSL sites under Install and Manage SSL for your site (HTTPS).
4. Select the domain, paste the certificate (CRT) and, if it is not filled automatically, the private key and CA bundle.
5. Click Install Certificate.

Note that AutoSSL will generally not replace a valid certificate you installed yourself, but it may replace one that has expired or become invalid.

Force your website to use HTTPS

Having a certificate does not automatically send visitors to the secure version. Turn on the redirect:

1. In cPanel, open Domains (in the Domains section).
2. Find your domain in the list and switch on the Force HTTPS Redirect toggle.
3. Visit http://yourdomain.com and confirm you are taken to https://.

The toggle is only available once a valid certificate covers the domain.

Extra step for WordPress sites

1. Log in to WordPress and go to Settings → General.
2. Change both WordPress Address (URL) and Site Address (URL) from http:// to https://, then save. You will be asked to log in again.
3. If some images or scripts still load over http://, the browser will show a “mixed content” warning. Fix this by updating old links in your content, or use a well-reviewed search-and-replace or SSL helper plugin.

Common problems and fixes

AutoSSL says “DCV failed” or validation error

The most common cause is that the domain does not point to this server. Check your A record and nameservers. Also check that .htaccess is not blocking access to the /.well-known/ folder, which is used for validation.

Certificate covers yourdomain.com but not www

The www record may be missing or pointing elsewhere. Add a CNAME or A record for www in Zone Editor, wait for it to work, then run AutoSSL again.

Padlock missing even though SSL is installed

This is almost always mixed content. Open the browser’s developer tools console to see which files load over http:// and update them.

Too many redirects after forcing HTTPS

You probably have two redirect rules fighting each other, for example one in .htaccess and another from a plugin or a CDN. Keep only one.

Frequently asked questions

Is a free SSL certificate safe?

Yes. Free DV certificates use the same strong encryption as paid DV certificates. Paid certificates mainly add organisation validation, support or a warranty.

Do I need to renew the free SSL myself?

No. AutoSSL and Let’s Encrypt tools renew automatically, as long as your domain still points to the server.

Does SSL protect my site from hackers?

Only partly. SSL protects data in transit. You still need strong passwords, updates and backups to keep the website itself secure.

Can I get SSL for subdomains?

Yes. AutoSSL automatically includes subdomains in your account that point to the server.

Conclusion

Getting a free SSL certificate in cPanel usually takes a single click on Run AutoSSL in SSL/TLS Status. Make sure your domain points to your hosting, switch on Force HTTPS Redirect, update your WordPress URLs if needed, and fix any mixed content. Your visitors get the padlock, and you get a safer, more trusted website at no extra cost.