Security guide
How to Install an SSL Certificate and Force HTTPS
In short
An SSL certificate gives you the padlock and HTTPS. It's free, expected by Google, and takes minutes to set up.
SSL encrypts the connection between your site and your visitors. Browsers flag sites without it as "Not secure", and HTTPS is a Google ranking signal, so every site needs one.
The easy way: free SSL in cPanel
Most hosts include free Let's Encrypt certificates. In cPanel, open SSL/TLS Status, tick your domains and click Run AutoSSL. The certificate installs and renews itself at no cost.
Via Cloudflare
If your site is behind Cloudflare, enable SSL there (set the mode to Full (strict) so it's encrypted end-to-end). Keep a valid certificate on the origin server too.
Force HTTPS everywhere
Installing the certificate doesn't move visitors onto HTTPS. Redirect all HTTP traffic to HTTPS. In cPanel use the "Force HTTPS Redirect" toggle, or add a redirect rule in .htaccess. On WordPress, set both URLs to https:// in Settings and use a plugin like Really Simple SSL to fix mixed content.
Fix mixed-content warnings
If the padlock doesn't show, something on the page still loads over HTTP (often an image or script). Update those URLs to https://; browser dev tools will list the offenders.
Check it worked
Visit your site with https://, confirm the padlock, and run a quick SSL test (e.g. SSL Labs) to confirm the certificate chain is valid.
Hosting with free SSL built in
Every Gander Web plan includes free auto-renewing SSL and forced HTTPS.
See hosting plansQuestions
Is a free SSL certificate as good as a paid one?
For most sites, yes. Let's Encrypt provides the same encryption. Paid certificates mainly add warranties or organisation validation.
How often do I renew SSL?
You don't. Let's Encrypt certificates last 90 days, and AutoSSL renews them automatically before they expire.
Why does my site still say "Not secure"?
Usually mixed content: an asset loading over HTTP. Update those URLs to HTTPS.