Free SSL Certificate Guide: What HTTPS Does and How to Get It

If your website still opens over http://, Chrome writes Not secure next to your domain, contact forms send visitor details in plain text, and Google has counted HTTPS as a ranking signal since 2014. The fix is a free SSL certificate, and on modern hosting it takes a few minutes with no renewal fee. This guide explains what the certificate does, why the free version is enough for most websites, and how to set it up and keep it working.

What an SSL certificate actually does

An SSL certificate is a small file installed on the server that lets a browser open an encrypted connection to your domain. The protocol in use today is called TLS, but the name SSL stuck, so hosts and control panels still use it. When the connection is encrypted, the address bar shows https:// and a padlock instead of a warning.

The certificate does three jobs at once. It encrypts everything sent between the visitor and your site, so passwords, order details and form submissions cannot be read on the way. It stops anyone in the middle, including an ISP or a public Wi-Fi network, from altering the page or injecting ads. And it proves the visitor is talking to the real owner of the domain rather than an impostor.

Why free SSL is as good as paid SSL for most websites

The encryption strength of a free certificate and a paid certificate is identical. Both use the same TLS protocol, the same key lengths and the same browser trust. What you pay for with a commercial certificate is the validation level and the extras around it, not stronger security.

Browsers no longer show a green company name for EV certificates, so visitors cannot tell an EV site from a DV site by looking at the address bar. For a Pakistani business website, an online store on WooCommerce, or a freelancer's portfolio, a free DV certificate is the right choice. This is why every ProWebHosting plan includes it as a standard feature rather than an upsell.

How Let's Encrypt works

Let's Encrypt is a non-profit certificate authority that issues DV certificates at no cost. It works through an automated protocol called ACME: your server asks for a certificate, Let's Encrypt checks that the domain really points at that server, and the certificate is issued within seconds. No forms, no emails to a validation department, no waiting.

• Certificates are valid for 90 days. This is deliberate, because short lifetimes limit the damage if a key is ever leaked.
• Renewal is automatic. The server requests a fresh certificate before the old one expires, so you never see an expiry warning if DNS is set up correctly.
• Validation is done over HTTP by placing a small file on your site, or over DNS for wildcard certificates. Your domain must already resolve to the server for this to succeed.
• Let's Encrypt applies rate limits per domain, so repeatedly deleting and re-issuing a certificate in one day can lead to a temporary block. Set it up once and leave it.

How to enable a free SSL certificate in DirectAdmin

On a DirectAdmin account the process is a few clicks. The one condition is that your domain's A record or nameservers must already point to your hosting account, because Let's Encrypt has to reach your site to validate it. If you have just changed DNS, give it a few hours before requesting the certificate.

The full click-by-click version with screenshots is in our DirectAdmin Let's Encrypt guide. The official reference for the SSL Certificates page is on docs.directadmin.com.

Fixing mixed content and other common SSL problems

The most common problem after enabling SSL is not the certificate itself, it is the website still loading some images, scripts or stylesheets over http://. Browsers call this mixed content. The page opens over HTTPS but the padlock is replaced by a warning, or certain images simply do not appear.

On WordPress, first change both the WordPress Address and Site Address under Settings to the https:// version. Then run a search and replace across the database to update old http:// links inside posts and theme settings; several free plugins do this safely. For a hand-coded site, search your HTML and CSS files for http:// and change those links to https:// or to protocol-relative paths.

• Certificate request fails: almost always DNS. Confirm the domain resolves to your hosting account, and check that no CAA record at your registrar blocks Let's Encrypt.
• Padlock on the home page but not on inner pages: leftover http:// links in specific posts or in a page builder's saved styles. Search and replace fixes it.
• Redirect loop after forcing HTTPS: usually a CDN or proxy in front of the site set to Flexible SSL mode. Switch it to Full or Full (strict) so both hops are encrypted.
• Browser shows an expired certificate: renewal did not run, most often because DNS was moved away from the server. Point DNS back or re-issue the certificate.

SSL for addon domains, subdomains and email

Each addon domain on your account gets its own free certificate; repeat the same steps with that domain selected. Subdomains such as shop.yourdomain.pk can be included in the main domain's certificate by ticking them in the list, or covered by a wildcard certificate if you use DNS validation.

Email is separate. Your mail app connects to the server's mail hostname, and that hostname carries its own certificate managed by the host. When setting up an email account on your phone or in Outlook, use the mail server name given in your welcome email rather than your own domain, and choose SSL or TLS for both incoming and outgoing servers. That avoids certificate mismatch warnings.

Frequently asked questions