Free SSL and HTTPS: How It Works and Why Every Site Needs It

An SSL certificate — strictly a TLS certificate — lets a visitor's browser encrypt the connection to your site and confirm that it has reached your domain and not an impostor. That is what turns http:// into https://. For most websites a free, automatically renewed certificate such as Let's Encrypt's protects visitors exactly as well as a paid one.

What HTTPS does, and what it does not

Without HTTPS, everything between the visitor and your server — pages, form entries, passwords — travels as plain text that anybody on the same network can read or change. With HTTPS:

• the connection is encrypted, so nobody in between can read it;
• it is protected from tampering, so nobody can inject ads or malware on the way;
• the browser checks the certificate, so it knows it reached the real owner of the domain.

What the padlock does not mean is that the site is honest. A phishing site can have a valid certificate for its own look-alike domain. HTTPS proves which domain you are talking to, not who runs it.

Why every site needs it, even without a shop

• Browsers mark plain HTTP pages as "Not secure", and warn loudly on pages with forms.
• Google has used HTTPS as a ranking signal since 2014.
• Modern browser features — faster HTTP/2 and HTTP/3 connections, location, notifications — work only over HTTPS.
• Your visitors' contact-form messages and your own admin password deserve encryption as much as a card number does.

Free or paid: what is the difference?

Certificates come in three validation levels:

• Domain validated (DV): proves you control the domain. Issued in minutes, automatically. Let's Encrypt and other free certificates are DV.
• Organisation validated (OV) and extended validation (EV): the authority also checks the company behind the domain. They cost money and take days.

The encryption is the same for all three. Browsers stopped showing the company name in the address bar for EV certificates years ago, so visitors see the same padlock either way. A paid OV or EV certificate makes sense when a contract, a bank or a regulator asks for one; for everything else, a free DV certificate is enough.

Certificates are getting shorter — automatic renewal is not optional

The rules browsers and certificate authorities agree on (the CA/Browser Forum's ballot SC-081) are cutting how long a certificate may be valid:

• at most 200 days for certificates issued since 15 March 2026;
• at most 100 days from 15 March 2027;
• at most 47 days from 15 March 2029.

Let's Encrypt's certificates have lasted 90 days; it has announced it will move its default to 64 days in February 2027 and to 45 days in February 2028 (Let's Encrypt: certificate lifetimes). At those lengths nobody can renew by hand reliably. Whatever certificate you use, make sure something renews it automatically and well before it expires.

How a free certificate is issued

Before issuing a DV certificate, the authority checks that you control the domain. The most common way (HTTP-01) is simple: the authority asks for a file on http://yourdomain/.well-known/acme-challenge/, and your server answers with a token. That only works if the domain already points to the server asking for the certificate. If you have just changed nameservers or DNS records, wait until the change has reached the authority — see how long DNS propagation takes.

Two other things stop a certificate being issued: a CAA record on the domain that allows only a different authority, and a name not covered — www.yourshop.com and yourshop.com are different names, and both need to be on the certificate if both are used.

SSL at Hostular

As of November 2026, every Hostular hosting plan includes a free Let's Encrypt certificate for each website. You turn it on for a site from your panel, once the domain points to our server; it is checked every day and renewed before it expires, and the certificate's private key is generated on the server and never leaves it. Each website also has a switch to force HTTPS, which sends every http:// request to https://.

Moving a site to HTTPS cleanly

1. Issue the certificate and open the site over https:// to check it.
2. Change the site's own address to https:// — in WordPress, under Settings → General, both "WordPress Address" and "Site Address".
3. Fix mixed content. A page loaded over HTTPS that pulls an image, script or stylesheet over http:// loses its padlock. Search your content and theme for http://yourdomain and change the links.
4. Redirect HTTP to HTTPS permanently (a 301), so old links and search results land on the secure address.
5. Tell search engines. Add the https:// version of your site in Google Search Console and submit your sitemap there.
6. Consider HSTS last. The Strict-Transport-Security header tells browsers to use HTTPS only. Add it once everything works; a long HSTS setting is hard to undo if you ever need plain HTTP again.