Activating SSL and forcing HTTPS

The certificate comes with the hosting

It is issued automatically once the domain points at our server. You do not have to ask for it or pay for it.

Check the state in cPanel, under SSL/TLS Certificates. The domain should show a green padlock and an expiry date.

When the certificate was not issued

The cause is almost always one of these two:

1. The domain does not point at our server yet. Check it against Pointing a domain at your hosting and wait for the change to spread.
2. The domain points through a third-party proxy. Validation will not pass until you switch that proxy off temporarily.

Once that is sorted, select your domain in SSL/TLS Certificates - for example *.yourdom.eu - click Continue and choose Let’s Encrypt Certificate.

Forcing HTTPS

To make the site always use a secure connection, add this to the .htaccess file in your document root:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

In WordPress it is enough to change the site address to https:// under Settings -> General instead.

Mixed content

If the browser says the page is not fully secure, something on it is loading over http:// - usually an image or a script. You will find it in the browser console, on the Console tab. In WordPress a link-rewriting plugin usually sorts it out, or you can change it directly in the database.

Set up the redirect to HTTPS only once the certificate has been issued. The other way round takes your site offline for a while.