How to Get a Free Let's Encrypt SSL Certificate in DirectAdmin

Every ProWebHosting plan includes a free SSL certificate from Let's Encrypt, and DirectAdmin issues and renews it for you. The whole setup takes about five minutes. This guide walks through the SSL Certificates page, which hostnames to include, how to force HTTPS, how renewal works and what to do when the padlock still refuses to show.

Before you start: make sure the domain points to your hosting

Let's Encrypt proves you control a domain by connecting to it over plain HTTP and looking for a small verification file that DirectAdmin places in a hidden folder. That only works if the domain already resolves to your hosting account. If you have just ordered hosting and your nameservers or A record still point at the old host, the certificate request will fail with a validation error.

The quick test: open http://yourdomain.com in a browser. If you see the placeholder page from your new account, or the site you uploaded here, DNS is ready. If you see the old host or an error, fix DNS first using our DirectAdmin DNS management guide and wait for propagation before continuing.

The same rule applies to every hostname you include in the certificate. If you tick www.yourdomain.com and mail.yourdomain.com, both must resolve to this server. When DirectAdmin hosts your DNS, it creates those records automatically. When your DNS is at a registrar or a third-party DNS service, add A records for www and mail yourself.

Step by step: issue the certificate in DirectAdmin

Force HTTPS so nobody lands on the insecure version

A certificate on its own does not redirect anyone. Visitors who type yourdomain.com without https, or follow an old link, still get the plain HTTP version until you turn on a redirect. DirectAdmin has a checkbox for exactly this: Force SSL with https redirect.

You will find the checkbox in two places. It appears under Account Manager, Domain Setup, when you click your domain, inside the private_html setup section. It also appears at the bottom of the SSL Certificates page. Tick it once, save, and the web server sends every HTTP request to the same address on HTTPS. Because the redirect happens at server level rather than in .htaccess, it is slightly faster and it works even if your .htaccess gets overwritten.

The checkbox is off by default for a good reason. Many sites already redirect to HTTPS through .htaccess rules or a WordPress plugin, and two competing redirects can loop. If you already have a redirect rule, remove one of them. Keeping the DirectAdmin one and deleting the .htaccess rule is the tidier choice.

For WordPress there is one more step. Go to Settings, then General, and change both WordPress Address (URL) and Site Address (URL) from http:// to https://. If you skip this, WordPress may keep generating http links for images and scripts, which causes the mixed content problem described below. If you installed WordPress with the app installer in your DirectAdmin account after the certificate was in place, the https URL was set for you.

How renewal works: 90 days, handled automatically

Let's Encrypt certificates are valid for 90 days, which the Let's Encrypt FAQ explains is a deliberate choice to encourage automation. DirectAdmin does the automating. Once a domain has an automatic certificate, DirectAdmin checks it once every 24 hours and renews it well before the expiry date. You do not need to log in, click anything or set a reminder.

Renewal only fails when something about the domain changed since the certificate was first issued. The table below lists the causes we see most often on shared hosting and what to do about each.

If you are not sure which of these applies, send us the domain name on WhatsApp. We can read the renewal log on the server and tell you exactly which hostname failed validation.

Fixing mixed content after switching to HTTPS

The most common complaint after installing SSL is: "The certificate is installed but the padlock is missing" or "the browser still says Not secure". Nine times out of ten this is mixed content. The page itself loads over HTTPS, but something inside it, an image, a stylesheet, a script or a font, is still requested over plain http://. Browsers refuse to show the padlock for a page like that.

• Open the page, press F12 to open the browser developer tools, and look at the Console tab. Each mixed content warning names the exact file being loaded over http.
• Hard-coded image URLs in posts and pages are the usual culprit on WordPress sites that were built before SSL was installed.
• Theme settings such as a logo URL, a background image or a favicon are often stored with the full http address.
• Embedded content from other sites, such as an old widget or a map iframe using http, cannot be fixed on your side. Replace it with the https version or remove it.

For WordPress, the reliable fix is a search and replace of http://yourdomain.com with https://yourdomain.com across the database. Several free plugins do this safely and handle serialized data. If you prefer to do it by hand, take a database backup first and use phpMyAdmin as described in our MySQL and phpMyAdmin guide. For a static HTML site, use File Manager to search your files for "http://" and change those links to https or to relative paths.

After the fix, clear any caching plugin and reload the page in a private window. The padlock should appear. Once it does, update the property in Google Search Console to the https version so reporting continues without a gap. For the background on why HTTPS matters in the first place, read our free SSL certificate guide.

Frequently asked questions