Free SSL explained: HTTPS on cPanel hosting in India

Most hosting plans in India say "free SSL" on the pricing card, but the label doesn't explain what you get, when the padlock shows up, or what to do when it doesn't. This guide explains all three in plain terms for anyone putting up a site on cPanel hosting.

What an SSL certificate actually is

An SSL certificate (the current technology is called TLS, but everyone still says SSL) is a small file on the server that does two jobs:

• It encrypts traffic between the visitor's browser and your site, so passwords, form entries and payment details can't be read on the way.
• It proves the site is really your domain. A certificate authority checks that whoever requested the certificate controls the domain before issuing it.

With a valid certificate, your site loads on https:// instead of http://, and the browser shows the secure-connection icon next to the address.

Why https matters for a small site

Even a five-page brochure site needs https today:

• Browser warnings. Chrome and other browsers label plain http pages "Not secure", more prominently on pages with forms. If a certificate has expired or doesn't match the domain, visitors get a full-page "Your connection is not private" screen instead of your site.
• Trust. A customer who types your domain from a visiting card or WhatsApp and sees a warning assumes the site is unsafe and closes the tab.
• Forms and payments. Contact forms, logins and checkouts send personal data, and payment gateways generally expect your site and callback URLs to run on https.
• Google. Google recommends https and uses it as a lightweight ranking signal. It won't lift a weak page on its own, and helpful content matters far more, but there's no reason to give it up.

What "free SSL" means on a cPanel host

Free SSL on cPanel is usually a domain-validated (DV) certificate, which only checks that you control the domain. The encryption is as strong as a paid certificate, and the browser shows the same secure icon. Paid certificates (OV or EV) add checks on the business behind the site, which a normal shop site, portfolio, blog or company page doesn't need.

On CheapHostIndia, free SSL is included on every plan (Starter, Growth and Pro) for every site on the plan. There's no certificate fee and nothing to buy. If you add another site on Growth or Pro, it gets its own certificate the same way. See everything each plan includes on our features page.

How the certificate is issued and renewed

Free SSL is issued by AutoSSL, cPanel's built-in automatic SSL feature:

• Your account is created automatically after payment, and your cPanel login details are emailed to you. The main domain is already on the account.
• You point the domain to the hosting.
• cPanel asks the certificate authority for a certificate, and the authority checks that the domain reaches your hosting.
• Once that check passes, the certificate is installed and https starts working.

Certificates renew automatically. You don't need to buy anything or set a reminder, as long as the domain keeps pointing to your hosting.

Pointing the domain is the step people miss: no certificate can be issued until your domain points to the host. Our guide to pointing your domain's DNS walks you through it.

Check the certificate status in cPanel

Log in to cPanel and open SSL/TLS Status in the Security section. It lists each domain on your account, including its www version, and shows whether a valid certificate is installed or what is blocking one. Once you've fixed the cause, you can use the option on that page to run the automatic check again instead of waiting.

Common SSL issues right after you point a new domain

Most first-day "SSL not working" messages come from timing, not a fault:

• The domain still shows the old host or a parking page. DNS hasn't updated everywhere yet. Wait, then check again.
• The certificate covers yourdomain.com but not www.yourdomain.com. The www name needs its own DNS record pointing to the hosting.
• A "certificate not valid" or "your connection is not private" warning. The server is usually showing a default certificate because yours hasn't been issued yet. If it still hasn't appeared after the domain points correctly, check SSL/TLS Status, or raise a support ticket from your client area.
• A redirect loop with Cloudflare. Its "Flexible" SSL mode talks to your server over plain http, so a server-side https redirect loops. Once your hosting certificate is active, switch Cloudflare to "Full (strict)".

How to check your site is on https

• Type http://yourdomain.com in the browser. It should switch to https:// on its own.
• Click the icon to the left of the address. It should say the connection is secure, and the certificate details show which domain it covers.
• Test both yourdomain.com and www.yourdomain.com.
• For a deeper check, use a free online test such as SSL Labs' SSL Server Test, and Google Search Console's URL Inspection to see which version Google crawled.

Force the https redirect

Send every http request to https with a permanent (301) redirect, so visitors and Google see one version of every page.

• In cPanel, the Domains page usually has a "Force HTTPS Redirect" switch for each domain. Turn it on once the certificate is active.
• If you don't see that switch, add these lines at the top of the .htaccess file in the domain's document root:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Redirect only once the certificate is active, or visitors hit a security warning.

Fix mixed content in WordPress

Mixed content means the page loads over https but some images, scripts or stylesheets still load from http://, so browsers may block them or drop the secure icon. It's common on WordPress sites first built on http. Fix it in this order:

• In WordPress, go to Settings → General and change both "WordPress Address (URL)" and "Site Address (URL)" to https://. Save, then log in again.
• Posts often contain full http://yourdomain.com/... image links. A search-and-replace plugin can change them to https:// across the database. Export a copy of the database first, and run the plugin's dry run before the real change.
• Check the theme and page builder for hard-coded http links in logos, backgrounds and custom CSS.
• Replace old map, video or widget embeds with fresh https codes.
• Press F12 on the page and check the browser console. Mixed-content warnings list the exact files still on http.

Installing WordPress fresh? Do it on the https address once the certificate is active, and you'll avoid most of this. Our WordPress checklist covers the order of steps.

A quick SSL checklist for a new site

• Point the domain (and www) to the hosting.
• Wait until the domain loads from the new host.
• Confirm in SSL/TLS Status that both names have a certificate.
• Turn on the https redirect.
• Install WordPress on https, or fix the site URLs and mixed content if it was on http.
• Check the secure icon on the homepage and form pages, on your phone too, before you share the link.

Stuck? Raise a support ticket from your client area with your domain name.

Pick a plan, then pay

Every CheapHostIndia plan includes cPanel, free SSL, unmetered bandwidth and automated weekly backups (JetBackup). Starter is ₹49/month (1 website, 5 GB SSD, 1 mailbox), Growth ₹69/month (5 websites, 20 GB SSD, 5 mailboxes) and Pro ₹99/month (unlimited websites, 50 GB SSD, unlimited mailboxes). Yearly is 10× monthly: ₹490, ₹690 or ₹990. Your account is created automatically after payment. Then point your domain, and the certificate follows. Compare the plans on pricing.