Free SSL on HostHere: How It Works & Fixing "Not Secure"

Every HostHere hosting plan includes a free SSL certificate. SSL (Secure Sockets Layer) is what puts the padlock icon in the browser address bar and changes your site address from http:// to https://. This article explains how it works and what to do if your site still shows as insecure.

What SSL Does

SSL encrypts the connection between your visitor’s browser and your web server. Without it:

• Browsers display a “Not Secure” warning in the address bar.
• Visitors see a full-page warning on some browsers before they can enter your site.
• Google treats HTTPS as a ranking signal — sites without it are at a disadvantage in search.

SSL does not make your site immune to other security issues, but it is a basic requirement for any site in 2026.

How HostHere’s Free SSL Works

HostHere uses Let’s Encrypt, a free certificate authority that is trusted by all major browsers. Certificates are issued automatically for your domain and subdomain (e.g. www.yourdomain.lk) when you activate them in cPanel.

Let’s Encrypt certificates are valid for 90 days and renew automatically. You do not need to purchase a certificate annually or manage renewal yourself.

Activating SSL in cPanel

SSL is not always active by default — you may need to enable it after pointing your domain:

1. Log in to cPanel (accessible at yourdomain.lk/cpanel or from your HostHere client area).
2. Scroll to the Security section and click SSL/TLS Status.
3. You will see a list of your domains. Any showing a yellow or red status does not yet have SSL active.
4. Tick the checkbox next to the domain(s) you want to secure.
5. Click Run AutoSSL.

cPanel will contact Let’s Encrypt, verify your domain, and install the certificate. This usually completes within a few minutes.

Forcing HTTPS

Installing an SSL certificate does not automatically redirect visitors from http:// to https://. Someone who types your domain without https:// will still land on the insecure version unless you force the redirect.

Option 1: Using cPanel In cPanel, go to Domains and click on your domain. Enable the Force HTTPS Redirect toggle if it is available.

Option 2: Via WordPress If you are running WordPress, install the Really Simple SSL plugin. It detects the certificate and sets up the redirect automatically.

Option 3: Via .htaccess Add these lines to the .htaccess file in your site’s root directory (back up the file first):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Why Your Site Might Still Show as Insecure

Even with SSL active and redirects in place, browsers may still show a warning. The most common reason is mixed content — the page is loaded over HTTPS, but it references resources (images, scripts, or stylesheets) using http:// URLs.

To fix mixed content in WordPress:

1. Install and activate the Better Search Replace plugin.
2. Search for http://yourdomain.lk and replace with https://yourdomain.lk across all database tables.
3. Clear any caching plugin’s cache after running the replacement.

For non-WordPress sites, search your HTML and CSS files for http:// references to your own domain and update them to https://.

When AutoSSL Fails

AutoSSL can fail if:

• The domain’s DNS has not fully propagated yet. Wait 24 hours after pointing nameservers and try again.
• The domain has a CAA DNS record that excludes Let’s Encrypt. This is uncommon but check your DNS records if AutoSSL consistently fails.
• There is a firewall or redirect on port 80 blocking Let’s Encrypt’s verification request.

If AutoSSL fails repeatedly, contact HostHere support on WhatsApp (+94 71 3811 430), Monday to Saturday, 10am–10pm SLT, with your domain name and the error message from the SSL/TLS Status page.