How to Get and Enable Your Free SSL Certificate

This article regarding HostGator's Free SSL (Secure Sockets Layer) certificates will cover the following topics:

• How to get a free SSL certificate ⤵
• Step-by-step guide to enable free SSL ⤵
• How to upgrade from free SSL to paid SSL ⤵
• How to opt out of the free SSL ⤵
• Frequently asked questions (FAQs) ⤵

How to get a free SSL certificate

Getting HostGator's Free SSL is easy. The Free SSL certificate will automatically be available to every domain and subdomain for new and existing cPanel platform customers. It lasts for 90 days from issuance and renews automatically at no cost to you, so your site hosted with HostGator should never be without an SSL certificate.

Terms to remember:

• Enable is the process of activating the SSL certificate.
• Enforcing is the process of forcing the website traffic from HTTP to HTTPS using 301 redirects.

Step-by-step guide to enable free SSL

• Step 1: Connect your domain to your HostGator hosting account ⤵
• Step 2: Enable the free SSL ⤵
• Step 3: Force the website traffic from HTTP to HTTPS ⤵

Step 1: Connect your domain to your HostGator hosting account

To get your Free SSL certificate, connect your website to your HostGator account. If it's already linked, your SSL is ready to use. Then, direct your customers from HTTP to HTTPS (go to the next step).

If another provider manages your domain, make sure to create an A record in your provider's DNS dashboard. After that, link that domain to your HostGator account to enable the Free SSL certificate. Without this, you can't use the Free SSL.

For more information on how to point (connect) your domain to HostGator, please check out the following articles:

• How do I change my DNS or name servers?
• How do I point my existing domain to HostGator?

Step 2: Enable the free SSL

1. Log in to your Customer Portal.
2. Go to Websites from the left navigation menu.
3. Click Manage Site next to the website you want to manage.

   
    

4. Navigate to the Security tab.

   

    
   • If the SSL is set properly, it will show an Active status.
   • If the SSL shows as In Progress, you should have received an email with instructions for activating your SSL.

     

   • If you do not see an active SSL, proceed to the next step.
5. Click the three-dot icon, then select View SSL logs.

   

6. You'll be redirected to your cPanel. Select your domain name and then click on the Run AutoSSL button.

   

Step 3: Force the website traffic from "HTTP" to "HTTPS"

The Free SSL does not automatically force HTTPS onto the domain or subdomain. It needs to be activated manually. This can be completed by editing the .htaccess to force HTTPS on every page.

The instructions for enabling Free SSL may vary depending on how you created your website. For more information on how to do this for popular applications or Content Management Systems (CMS), please click the expandable sections below.

How to enable SSL in WordPress

Here is a video tutorial on how to force HTTPS using the Simple SSL WordPress plugin.

To enable HTTPS on your WordPress installation, HostGator recommends using the WordPress Simple SSL plugin.

For more information regarding HTTPS in WordPress, please visit the following article:

• WordPress HTTPS (SSL) plugin

How to enable SSL in Joomla

To force HTTPS onto a Joomla site:

1. Log in to your cPanel.
2. Under the Files section, click on File Manager.

   

3. In the File Manager, navigate to your domain's document root (directory) and locate the configuration.php file.
4. In the configuration.php file, look for the line that contains
   $live_site ='';
    
5. Update the line to add your domain, including HTTPS,
   Example: $live_site = 'https://www.example.com';
    
6. Locate the associated .htaccess file for the domain and add the following code:
   RewriteEngine On
RewriteCond %{HTTPS} OFF
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
7. Open your Joomla admin panel, then click Global Configuration.
    
8. Go to the Server tab, then click on Server Settings.
    
9. You will be presented with three options for how HTTPS should function for your Joomla installation. Select preferred settings.
   • None: HTTPS will be disabled.
   • Administrator-only: Forces the administrator page to use HTTPS.
   • Entire site: All pages will use HTTPS.
      
10. Click Apply/Save to update your Joomla site.

How to enable SSL in Magento

To force HTTPS onto a Magento site:

Magento 1.x

1. Log in to your Magento admin panel.
2. Navigate to System, then Configuration.
3. In the General section, select Web.
4. Open the Secure section and update the Base URL to:
   https://yourdomain.ext
5. The Use Secure URLs in Frontend and Use Secure URLs in Admin options must be set to Yes.
6. Click Save Config.
7. To see the changes appear, you will need to clear the Magento cache.

Magento 2.x

1. Log in to your Magento admin panel.
2. Navigate to Stores> Configuration> Web.
3. Open the Base URLs (Secure) section and update the URL in the Secure Base URL to:
   https://yourdomain.ext
4. The Use Secure URLs on Storefront and Use Secure URLs in Admin options must be set to Yes.
5. Click Save Config.
6. To see the changes appear, you will need to clear the Magento cache.

How to enable SSL in Drupal

To force HTTPS onto a Drupal site, add the following code to your .htaccess file:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com*
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

For instructions on editing the .htaccess, please visit the How to Edit Your .htaccess File article.

How to enable SSL for Website Builder

To force HTTPS onto the Website Builder site, add the following code to your .htaccess file:

RewriteEngine On
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

For instructions on editing the .htaccess, please visit the How to Edit Your .htaccess File article.

How to manually enable and force HTTPS in cPanel

To manually force HTTPS on a site:

1. Add the following script to the top of the .htaccess file.

   RewriteEngine On   
   RewriteCond %{HTTPS} !=on   
   RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]  
   

2. Additionally, you can input the following script to fix the Mixed Content warning on your site.

   RewriteOptions inherit   
   RewriteEngine on   
   Header set content-Security-Policy: upgrade-insecure-requests   
   

   

3. Once done, click the Save Changes button in the upper-right corner.

   

4. Clear your cache, and your WordPress site will automatically redirect to HTTPS without a plugin.

For instructions on editing the .htaccess, please visit the How to Edit Your .htaccess File article.

Workaround: Please try these additional steps if the site is not redirected to HTTPS after adding the above script to your .htaccess file.

1. Log in to your WordPress Dashboard.
2. On the left pane, look for Settings.

   

3. Hover over Settings, then select General.
4. Under General Settings, look for the WordPress Address (URL) and Site Address (URL) fields.

   

5. Update both URLs to reflect https (https://yourdomain.ext).

   

6. Scroll down and click Save Changes.
7. You will receive a successful confirmation prompt at the top of the page.

   

How to enable the free SSL and manually force HTTPS in Plesk

To enable the Free SSL and force HTTPS in Plesk for a domain:

Step 1: Enable the free SSL

Please note that the "www." subdomain will not be covered unless you include a www subdomain for the domain and each selected alias option is selected.

1. Log in to the Plesk Control Panel.
2. Go to the Websites & Domains tab.
3. Locate and click SSL/TLS Certificates.
4. Click Let's Encrypt under the domain.
5. Confirm the email address is valid.
6. Click Install.

A notification will be sent to the email address specified before the SSL expires. The SSL will automatically renew 30 days before it expires, or it can be renewed manually at any time.

Step 2: Force HTTPS

1. Log in to the Plesk Control Panel.
2. Go to the Websites & Domains tab.
3. Click on Hosting Settings under the domain.
4. Under Security, select the checkbox labeled "Permanent SEO-safe 301 redirect from HTTP to HTTPS."
5. Scroll down and click OK to save.
6. Return to Websites and Domains or click Apply to save and stay in the Hosting Settings.
7. Navigate to your website to test the SSL certificate. The SSL certificate will work correctly if you are redirected to the secure HTTPS:// version of your site.

How to upgrade from free SSL to paid SSL

If you're using a Free SSL and you want to upgrade to a paid SSL, it's easy to do so through your Customer Portal. HostGator offers different types of SSL certificates, and it's important to understand the differences before making a decision. You can find this information in the following support article:

• What type of SSL/Secure Certificate do I need?

Once you're ready to upgrade, simply visit the article:

• Customer Portal - SSL Certificates

How to opt out of the free SSL

To opt out of the Free SSL certificate:

1. Log in to your Customer Portal.
2. Go to Websites from the left navigation menu.
3. Click Manage Site next to the website you want to manage.

   
    

4. Click on the Settings button of the website you are working on. 
5. Navigate to the Security tab.

   

6. Click the three-dot icon on the right, then select View SSL Logs.

   

7. Click on the checkbox next to the domain name for which you are opting out of the free SSL, then select Exclude Domain from AutoSSL.

   

8. Click on View Certificate.

   

9. Locate the domain you are opting out of for the free SSL certificate and click on Uninstall.

   

Frequently asked questions (FAQs)

Do I have to activate the Free SSL on my subdomain if it is already activated on my primary domain?

First, what's the difference between a domain and a subdomain?

A domain name is the address of a website. It is the URL that a visitor types into a browser.

A subdomain is an add-on to your primary domain name. Essentially, a subdomain is a separate part of your website that operates under the same primary domain name.

Domain: example.com
Subdomain: sales.example.com

To answer the main question: Yes, you need to activate the Free SSL on your subdomain, even if your primary domain already has an active Free SSL. Both are considered separate websites with their own website content and .htaccess files. The steps for activating the subdomain's Free SSL are the same as for the primary domain, as discussed above.
 

When viewing my domain over HTTPS, why does it say I don't have a certificate on my site?

• You must have an actively shared cPanel package with HostGator.
• The domain must be pointed to your HostGator hosting via an A record.
• Clear your browser cache and try viewing the site on another device after you enable the SSL certificate. Sometimes the old version of the website will be cached in your browser.

Which hosting plan includes free SSL?

All HostGator hosting packages include free SSL certificates for all domains hosted within the account and pointed by an A record. 

Advanced hosting users with a VPS or Dedicated plan may enable it for their servers by following the guide below.

• Manage AutoSSL in WHM

What do I have to do once I get the Free SSL?

Once the Free SSL is installed, you will likely need to direct your visitors from HTTP to HTTPS to ensure they use the most secure path to access your site. Please see the instructions above.