According to many search engines, such as Google, secure sites benefit from higher ranking points. This means that your site can rank higher if it starts with HTTPS. This happens because secure Socket layers protect website visitors from various types of harm by encrypting the data transfer. It becomes much, much harder to break in and steal information in this mode. Installing a WordPress SSL certificate is one of the easiest and most practical ways to do it when you want to protect your users while simultaneously increasing your pages’ search rankings. Website design is one of the branches of online marketing, read the digital marketing article to know about other branches.

What is an SSL certificate?

Before we get into how to install SSL, let’s see what exactly they are. An SSL certificate is a small data file that digitally binds a cryptographic key to an organization’s information.

SSL stands for Secure Sockets Layer, which is a global security standard technology. SSL enables encrypted communication between a web browser and a web server. When you install one of them on your website, it will enable Padlock and HTTPS protocol. This creates a secure connection between the web server and the browser. In the past years, you could mainly see SSL certificates only for sites that had financial transactions and collected personal information.

Over time, they became popular for all social networking sites. Then, Google started encouraging all sites to have an SSL. Nowadays, it is highly recommended to have one of them for your website. Finally, it should be said that an SSL certificate ties these two things together:

A domain name, server, or name

An organizational identity (such as a company name) and a location

How to install a free SSL certificate

Usually, paid SSL certificates are expensive. If you are just starting to start a blog or your business website, you should keep your expenses to a minimum. Fortunately, there are several ways to get a free SSL certificate to reduce website costs. Many website owners refuse to use SSL because of the additional costs. This leaves many small websites vulnerable to data theft.

A charity project called Let’s Encrypt has decided to solve this problem by making it possible to install SSLs for free. The purpose of this project is to simplify obtaining an SSL certificate for website owners. As more sites use SSL, the Internet will become a safer place.

Due to the usefulness of this project, they were able to quickly receive the support of huge companies such as Google, Facebook, Shopify, WordPress, and many others. The main challenge here is that installing a free SSL certificate by Let’s Encrypt is very difficult for a beginner because it requires knowledge of coding and server systems.

Fortunately, all of the top WordPress hosting companies now offer free SSL certificates with all of their hosting services. Choosing one of these providers will save you the trouble of installing a free SSL certificate yourself. In the list below, you can see these hosting providers that provide you with SSL certificates for free with their services.

  • Bluehost
  • SiteGround
  • HostGator
  • WPEngine
  • Dreamhost
  • InMotion Hosting
  • GreenGeeks
  • IPage
  • Liquid Web

If you are currently using the services of one of these companies, you can activate your free SSL certificate from your dashboard. Just log in to your cPanel hosting account and go to the Security section.

BlueHost users will see the Free SSL option by going to My Sites and then Manage Site. In this section, you can go to the Security tab and activate your site’s free SSL certificate. Depending on your hosting provider, if you have trouble finding the free SSL option, you can ask your host to enable it for you.

Install a free SSL certificate for WordPress

Once you’ve activated your free SSL certificate, you’ll need to make WordPress start using HTTPS instead of HTTP on all your URLs. The easiest way to do this is to install and activate the Simple SSL plugin on your website.

During activation, the plugin first checks to see if your SSL is enabled. Then, it starts HTTP to HTTPS redirects and changes your website settings to use SSL and HTTPS.

To complete the security of your website, you must ensure that your website URLs are loaded using HTTPS protocols. The Simple SSL plugin does this automatically by correcting the URL at page load time.

Even if a page is still loaded using insecure HTTP protocols, the browser will treat your website as if the entire site is insecure. To fix these URLs, you need to use your browser’s Inspector tool to find them and replace them with proper HTTPS links. The Simple SSL plugin makes it very simple to set up free SSL on your WordPress website. That’s why we highly recommend it for beginners.

However, this plugin will block unsafe URLs during page loading and this will increase your page loading time. This is why advanced users who are concerned about the speed of their WordPress site use manual methods to set up their SSL certificate.

In addition to the free and convenient method that was told to you above, there are other ways to install and set up an SSL certificate on the site, which are worth looking at.

Install a custom SSL certificate

1- Buy an SSL certificate

You can purchase your SSL certificate from any vendor such as Comodo, DigiCert, GeoTrust, Thawte, or Trustwave. Platforms like Kinsta and many others support all models of SSL certificates.

2- Server type

When purchasing a new SSL certificate, you will be asked to specify the server type. Our web server model is Nginx, if you don’t have this option, Apache or “Other” will do the same for you.

3- Activation of CSR and Private Key

The SSL provider requires a CSR code to create and sign the certificate file. To generate a CSR code and RSA key, you can fill out the following form: https://www.ssl.com/online-csr-and-key-generator/

We recommend that you fill in all the boxes, but you should at least be able to provide the following sections:

  • common name (domain name)
  • E-mail
  • Organization
  • City/Area
  • Province/neighborhood/region
  • Country

Keep in mind that for the common name field, if you use a Wildcard certificate, you must enter your domain name as .domain.com. This form will generate a private key file and CSR for you. Make sure to save both of them as the certificate will be unusable without them.

Step 4

Upload your CSR along with your SSL provider to activate your SSL certificate.

Step 5

Login to your dashboard page, click on a site, go to the Tools tab, and click on Add Custom HTTPS Credentials to get started.

Step 6

To use the desired credentials, you must have a .key and .cert file ready. Then click Next.

Step 7

You can then add your private key and certificate. Keep in mind, that some clients may want to have their intermediary certificates as well. Most SSL providers will send you an email containing a .crt and .ca-bundle file. Paste the contents of your .crt file into the Certificate section first, and then do the same for the contents of the .ca-bundle file underneath. You can use a text editor such as Notepad or TextMate to open the bundle files and certificates. If you don’t have your intermediate certificates or don’t know them, you can use a free tool like www.whatsmychaincert.com to activate them. Then click on Apply Certificates.

Installing an SSL certificate by Cloudflare or Sucuri

Cloudflare and Sucuri are known as reverse proxy services. You can look at them with the eyes of an intermediary. You point your DNS at them and in return, they route your requests to your servers. To do this, there are a few extra steps you need to take to make sure your SSL certificates are installed correctly.

To do this in Cloudflare

Cloudflare offers two configuration models for site loading on HTTPS: Flexible and full.

Flexible allows an HTTP connection between Cloudflare and the servers and does not require an SSL certificate.

Full requires an HTTPS connection between Cloudflare and the servers.

The steps to follow are as follows:

Step 1

In Cloudflare, click on the Crypto tab and turn off SSL. (It is also recommended to put CloudFlare in development mode until SSL is ready on the other side, the server. You can do this from the Quick Actions section of the dashboard.)

Step 2

In this step, you need to install your free or custom SSL certificate on the server.

Step 3

Once your SSL certificate is successfully installed on the server (let’s say Kinsta), set the Crypto level in Cloudflare to Full or Full (Strict) to encrypt the communication from the server to the recipient’s browser.

Step 4

It’s time to clear the cache in Cloudflare. If you put your site in development mode, make sure you revert it to the original state.

To do this in Sucuri

First, you should contact their support and ask them to activate the Forward Certificate Validation settings. This will ensure HTTPS provisioning completes successfully. Then you can install your free or custom SSL certificate with the methods mentioned above.

Check the SSL certificate

After you have installed your SSL certificate, we recommend that you perform an SSL Check to confirm that everything is installed correctly. Invalid SSL certificates can cause your audience to encounter Your Connection is not Private error.

SSL certificate renewal

Free SSL certificates: Free SSL certificates installed on some servers like Kinsta are automatically renewed after 90 days. You don’t have to do anything. Otherwise, if your site is behind a reverse proxy like Sucuri, you should contact their support and ask them to enable Forward Certificate Validation, which will allow successful HTTPS renewal.

Custom SSL Certificates: If you have a custom SSL certificate, you must renew it through the SSL provider or domain registrar where it was purchased. As long as your certificate is renewed before it expires, you don’t need to re-upload it to different servers like Kinsta.

HTTPS Mandatory

If you use Kinsta, you have the option to “Force HTTPS” in your dashboard. This feature allows you to automatically forward all incoming requests over HTTPS.

This tool gives you two options; “Drive all traffic to the main domain” and “Use the requested domain”. For regular WordPress sites, it is recommended to use the first option, which creates a 301 redirect to the HTTPS version of your canonical domain. The second option is useful for WordPress multisites that may have several domains located on Kinsta.

Remove the SSL certificate

There may be times when you need to remove your SSL certificate, whether it’s free or custom-purchased. Maybe you’ve been testing an HTTPS migration, or maybe you wanted to migrate your site to Let’s Encrypt certificates. To remove the HTTPS certificate, just click Remove HTTPS Certificates under the Tools menu and the Enable HTTPS option.

Leave a Reply

Your email address will not be published. Required fields are marked *