SSL
SSL and HTTPS on a free host, start to finish
What the padlock actually means, how to switch a site to HTTPS without breaking it, and how to fix it when the browser warns people away.
- SSL/TLS is what puts the padlock in the address bar and the S in HTTPS.
- On a free host you turn it on once; the certificate then renews itself.
- After you switch on HTTPS you have two jobs: force it, and fix mixed content.
- Most SSL “errors” are one of three things, and each has a short, known fix.
- You do not pay for a basic certificate. Anyone charging you for one is selling water.
The padlock in the address bar means one thing: the connection between the visitor and your site is encrypted, so nobody in between can read or change it. The technology behind it is called TLS, though almost everyone still says SSL. This page is the map of what you actually do with it as a site owner.
The good news first. A basic certificate is free, it is automatic on any decent host, and it renews itself. You should never pay for one for a normal website. The work is not in getting the certificate. It is in the two small jobs that come after, and in knowing which of a handful of errors you are looking at.
Turning it on
On a free host, SSL is a switch, not a purchase. You turn it on once and the host requests a certificate from a free authority, installs it, and renews it before it expires. The full walk-through, including what to do while the certificate is still being issued, is in enable free SSL.
The certificate covers your subdomain and any custom domain you have pointed at the host. You do not need a separate one for each. If the switch does nothing, the usual cause is that your domain is not yet pointing at the host, which is a DNS problem rather than an SSL one.
The two jobs after it works
Getting a certificate is not the finish line. A site can have a valid certificate and still serve most of its pages without it. Two things need doing.
The first is to force HTTPS. Once the certificate works, every visitor should be sent to the secure version, every time, even if they typed the plain address. You do this with a short redirect rule. See force HTTPS for the exact lines and where they go.
The second is to fix mixed content. This is when a secure page still pulls in an image, script, or stylesheet over the old insecure address. The browser sees it, drops the padlock, and may block the resource. The page looks broken for no obvious reason. The fix, and how to find every instance, is in the mixed-content guide.
When the browser warns people away
A broken certificate is worse than none, because the browser throws a full-page warning that scares visitors off. Almost every case is one of three things.
The certificate has expired or failed to renew, which on a free host usually
means the domain stopped pointing at the host, so the renewal could not be
checked. The certificate is for the wrong name, so it covers example.com but
the visitor arrived at www.example.com. Or the connection itself is failing,
which the browser reports as a protocol error. That last one is walked through
in ERR_SSL_PROTOCOL_ERROR.
The pattern is always the same: read what the browser says, match it to one of those three, apply the known fix. You are never guessing.
It helps to be clear on what the padlock does and does not promise. It means the connection is encrypted, so nobody between the visitor and the server can read or tamper with the traffic. It does not mean the site is safe, honest, or run by who you think. A phishing page can hold a valid certificate. So the padlock is necessary for a real site and worth nothing as a trust signal on its own, which is why browsers stopped showing a reassuring word next to it.
The whole setup on a free host
If you are setting up HTTPS from scratch, the order is:
- Point your domain at the host first. SSL cannot be issued for a name that does not resolve to you.
- Turn on the certificate and wait for it to be issued.
- Force HTTPS so everyone lands on the secure version.
- Fix any mixed content so the padlock stays on every page.
- Leave renewal alone. It is automatic, as long as the domain keeps pointing at the host.
That is the entire job. Each step is a linked how-to, and none of them costs money. The only recurring thing to watch is your domain: because renewal depends on the certificate authority reaching your site, the day HTTPS quietly breaks is almost always the day something changed in DNS, not in SSL. Fix the pointing and the padlock comes back on its own.