An SSL certificate gives you the padlock and HTTPS. It's free, expected by Google, and takes minutes to set up.
SSL encrypts the connection between your site and your visitors. Browsers flag sites without it as "Not secure", and HTTPS is a Google ranking signal, so every site needs one.
The easy way: free SSL in cPanel
Most hosts include free Let's Encrypt certificates. In cPanel, open SSL/TLS Status, tick your domains and click Run AutoSSL. The certificate installs and auto-renews, no cost, no manual renewals.
Via Cloudflare
If your site is behind Cloudflare, enable SSL there (set the mode to Full (strict) so it's encrypted end-to-end). Keep a valid certificate on the origin server too.
Force HTTPS everywhere
Installing the certificate isn't enough, redirect all HTTP traffic to HTTPS. In cPanel use the "Force HTTPS Redirect" toggle, or add a redirect rule in .htaccess. On WordPress, set both URLs to https:// in Settings and use a plugin like Really Simple SSL to fix mixed content.
Fix mixed-content warnings
If the padlock doesn't show, something on the page still loads over HTTP (often an image or script). Update those URLs to https://; browser dev tools will list the offenders.
Check it worked
Visit your site with https://, confirm the padlock, and run a quick SSL test (e.g. SSL Labs) to confirm the certificate chain is valid.
Key takeaways
- Free Let's Encrypt SSL is built into cPanel, just run AutoSSL.
- Installing isn't enough, force HTTPS with a redirect.
- Fix mixed content if the padlock doesn't appear.
- HTTPS is expected by browsers and rewarded by Google.
Hosting with free SSL built in
Every Gander Web plan includes free auto-renewing SSL and forced HTTPS.
See hosting plansFrequently asked questions
Is a free SSL certificate as good as a paid one?
For most sites, yes. Let's Encrypt provides the same encryption. Paid certificates mainly add warranties or organisation validation.
How often do I renew SSL?
AutoSSL/Let's Encrypt renews automatically every 90 days, so you don't have to think about it.
Why does my site still say "Not secure"?
Usually mixed content: an asset loading over HTTP. Update those URLs to HTTPS.