Content Website Platform cwp.sg

Tutorial

How to enable free SSL on your site

Getting the padlock without paying for a certificate, and the two things that stop it working afterwards.

Ben Johnson · last checked 2026-09-21 · 4 min read

TL;DR
  • DNS must point to our servers before the automatic SSL certificate can be issued.
  • A certificate only makes HTTPS possible; you must add a redirect in .htaccess to force visitors to the secure address.
  • Check your pages for mixed content — any file loading over plain HTTP will break the padlock.
  • The certificate costs nothing and renews automatically, but the redirect and asset fixes are your responsibility.

The browser is showing “Not Secure” because your site is still serving pages over plain HTTP. The certificate is free and already being handled for you. What remains is your job: redirect traffic to HTTPS and fix anything that still loads over HTTP.

CWP free hosting issues an automatic SSL certificate for every domain you point at us. You do not need to buy one, paste a key, or renew it. The system handles all of that. What the system cannot do is guess whether you want visitors to use the secure address. That part is yours.

Before the certificate works: DNS must be correct

The most common reason a certificate never arrives is that the domain does not point to our servers. The automatic SSL system must see your domain resolving to our IP address before it can issue anything. If you have not changed your DNS nameservers or added an A record, the certificate will stay pending or fail entirely.

Point your domain’s A record to the IP address you received when you set up the account. If you are using our nameservers, this is already done. Allow up to a few hours for DNS to propagate. If the certificate still does not appear after a day, check that your domain actually resolves to us. A certificate cannot be issued for a server it cannot reach.

If a visitor gets a ERR_SSL_PROTOCOL_ERROR in their browser, the handshake is failing. That usually means the certificate does not match the domain or is missing entirely. Start by confirming DNS points here.

A certificate does not redirect anyone

You can have a perfect certificate installed and still serve the entire site over plain HTTP. The certificate only makes HTTPS possible. It does not force anyone to use it. The user must type https:// themselves, and links from search engines or other sites will still hit the HTTP version.

You must add a redirect that tells every visitor and every bot to use the secure URL. This is done with a rewrite rule in a file called .htaccess in your site’s public folder. If you are not comfortable writing the rule yourself, use the .htaccess generator to build one. Select the option to redirect HTTP to HTTPS and paste the output into your .htaccess file.

A proper HTTPS redirect looks like this:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Place this before any other rewrite rules. Once it is live, type the old http:// address of your site. You should be sent to the https:// version immediately. If you see a redirect loop, check that you do not have a conflicting rule below it.

Read the guide on forcing HTTPS for a more detailed walkthrough and a few edge cases to watch for.

Fix assets that still load over HTTP

Once the redirect is in place, the address bar will show a padlock. But the padlock may be open or show an information triangle. That means your page is loading some files over plain HTTP while the page itself is on HTTPS. This is called mixed content. Modern browsers block or warn about it.

The fix is to find every image, stylesheet, script and font linked with http:// and change it to https://. If your site uses relative links like /images/photo.jpg instead of https://yoursite.com/images/photo.jpg, those are fine — they inherit the protocol of the page. The problem is absolute links with http:// still hard-coded.

Your browser’s developer tools will list the blocked resources. Open the console tab (F12 in most browsers) and look for warnings about mixed content. Each entry tells you the exact URL that is still HTTP. Change that URL in your site’s code or content.

The mixed content error page explains what is blocked and how to find it if the console is not showing enough.

What SSL does not change

Free SSL on CWP covers the certificate itself and the automatic renewal. It does not include:

  • Outbound email or SMTP (blocked on free hosting — you cannot send email from your site, secure or not)
  • Any guarantee of uptime or availability
  • Backups of your certificates or your site

If your site sends login credentials, personal data or payment information, HTTPS is the minimum. You should also consider whether the rest of the stack — the software versions, the database, the file permissions — is secure enough for that kind of data. Free shared hosting has hard resource limits that may not suit a production store or a membership site.

Enabling free SSL on your site

To summarise the three steps:

  1. Make sure your domain’s DNS points to our servers so the certificate can be issued.
  2. Add a redirect in .htaccess to force all visitors to HTTPS.
  3. Check for mixed content and change any hard-coded http:// links to https:// or relative paths.

The certificate is free. The work is in the redirect and the asset audit. Once both are done, the Not Secure warning will disappear and stay gone as long as the renewal runs automatically.