# How to enable free SSL on your site > Getting the padlock without paying for a certificate, and the two things that stop it working afterwards. Source: https://cwp.sg/tutorials/enable-free-ssl/ Author: Ben Johnson Last verified: 2026-09-21 **In short:** - DNS must point to our servers before the automatic SSL certificate can be issued. - A certificate only makes HTTPS possible; you must add a redirect in `.htaccess` to force visitors to the secure address. - Check your pages for mixed content — any file loading over plain HTTP will break the padlock. - The certificate costs nothing and renews automatically, but the redirect and asset fixes are your responsibility. The browser is showing "Not Secure" because your site is still serving pages over plain HTTP. The certificate is free and already being handled for you. What remains is your job: redirect traffic to HTTPS and fix anything that still loads over HTTP. CWP free hosting issues an automatic SSL certificate for every domain you point at us. You do not need to buy one, paste a key, or renew it. The system handles all of that. What the system cannot do is guess whether you want visitors to use the secure address. That part is yours. ## Before the certificate works: DNS must be correct The most common reason a certificate never arrives is that the domain does not point to our servers. The automatic SSL system must see your domain resolving to our IP address before it can issue anything. If you have not changed your DNS nameservers or added an A record, the certificate will stay pending or fail entirely. Point your domain's A record to the IP address you received when you set up the account. If you are using our nameservers, this is already done. Allow up to a few hours for DNS to propagate. If the certificate still does not appear after a day, check that your domain actually resolves to us. A certificate cannot be issued for a server it cannot reach. If a visitor gets a [ERR_SSL_PROTOCOL_ERROR](/errors/err-ssl-protocol-error/) in their browser, the handshake is failing. That usually means the certificate does not match the domain or is missing entirely. Start by confirming DNS points here. ## A certificate does not redirect anyone You can have a perfect certificate installed and still serve the entire site over plain HTTP. The certificate only makes HTTPS possible. It does not force anyone to use it. The user must type `https://` themselves, and links from search engines or other sites will still hit the HTTP version. You must add a redirect that tells every visitor and every bot to use the secure URL. This is done with a rewrite rule in a file called `.htaccess` in your site's public folder. If you are not comfortable writing the rule yourself, use the [.htaccess generator](/tools/htaccess-generator/) to build one. Select the option to redirect HTTP to HTTPS and paste the output into your `.htaccess` file. A proper HTTPS redirect looks like this: ``` RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L] ``` Place this before any other rewrite rules. Once it is live, type the old `http://` address of your site. You should be sent to the `https://` version immediately. If you see a redirect loop, check that you do not have a conflicting rule below it. Read the guide on [forcing HTTPS](/tutorials/force-https/) for a more detailed walkthrough and a few edge cases to watch for. ## Fix assets that still load over HTTP Once the redirect is in place, the address bar will show a padlock. But the padlock may be open or show an information triangle. That means your page is loading some files over plain HTTP while the page itself is on HTTPS. This is called [mixed content](/errors/mixed-content/). Modern browsers block or warn about it. The fix is to find every image, stylesheet, script and font linked with `http://` and change it to `https://`. If your site uses relative links like `/images/photo.jpg` instead of `https://yoursite.com/images/photo.jpg`, those are fine — they inherit the protocol of the page. The problem is absolute links with `http://` still hard-coded. Your browser's developer tools will list the blocked resources. Open the console tab (F12 in most browsers) and look for warnings about mixed content. Each entry tells you the exact URL that is still HTTP. Change that URL in your site's code or content. The [mixed content error page](/errors/mixed-content/) explains what is blocked and how to find it if the console is not showing enough. ## What SSL does not change Free SSL on CWP covers the certificate itself and the automatic renewal. It does not include: - Outbound email or SMTP (blocked on free hosting — you cannot send email from your site, secure or not) - Any guarantee of uptime or availability - Backups of your certificates or your site If your site sends login credentials, personal data or payment information, HTTPS is the minimum. You should also consider whether the rest of the stack — the software versions, the database, the file permissions — is secure enough for that kind of data. Free shared hosting has hard resource limits that may not suit a production store or a membership site. ## Enabling free SSL on your site To summarise the three steps: 1. Make sure your domain's DNS points to our servers so the certificate can be issued. 2. Add a redirect in `.htaccess` to force all visitors to HTTPS. 3. Check for mixed content and change any hard-coded `http://` links to `https://` or relative paths. The certificate is free. The work is in the redirect and the asset audit. Once both are done, the Not Secure warning will disappear and stay gone as long as the renewal runs automatically. --- Content Website Platform (cwp.sg) operates the free hosting it writes about; see https://cwp.sg/about/ for the methodology and the commercial disclosure.