Quick answer: Web hosting with free SSL means your host issues and installs a TLS certificate for your domain at no extra cost, so your site loads over HTTPS with the padlock in the browser. A free certificate encrypts traffic just as well as a paid one. What matters is that it covers every domain you use and renews on its own.
Most hosting plans now advertise web hosting with free SSL, and that is a good thing. A few years ago a certificate was a separate purchase with its own renewal date and an install step that confused plenty of site owners. Today it is usually part of the plan. But “free SSL” on a pricing table can mean slightly different things from one host to the next, and the details decide whether your site stays on HTTPS without you thinking about it. This guide explains what a free certificate actually does, how it compares with a paid one, and the short list of things to check before you buy. If you are still deciding what kind of hosting you need, start with our explainer on what shared hosting is and how it works.
What is SSL, and why does every website need it?
SSL, now properly called TLS, is the technology that encrypts the connection between a visitor’s browser and your website. When it is in place, your address starts with https:// and browsers show the site as secure.
Without it, anything a visitor types into your site, such as a contact form, a login or a checkout, travels across the internet in plain text. Modern browsers warn people about that. Major browsers flag plain HTTP pages as “Not secure”, and many visitors leave the moment they see that label. Search engines treat HTTPS as the normal standard too, so a site without it starts at a disadvantage.
The certificate itself is a small file that proves your server is allowed to serve your domain. A certificate authority checks that you control the domain, then signs the certificate. Your hosting server uses it to set up the encrypted connection each time someone visits.
What does “web hosting with free SSL” actually include?
On a plan with free SSL, the host requests the certificate for your domain, installs it on the server and, on a well-run platform, renews it before it expires. You don’t buy anything separately or paste certificate files anywhere.
Most free certificates are Domain Validated (DV) certificates. The certificate authority confirms that you control the domain, usually by checking a file on your hosting or a DNS record, and that’s all. Many hosts use free certificate authorities such as Let’s Encrypt, which was set up specifically to make HTTPS free and automatic. Its documentation on how domain validation works is a clear, short read if you want to see what happens behind the scenes.
Free certificates tend to have short lifetimes, often around 90 days. That sounds alarming, but it is deliberate: short certificates limit the damage if one is ever misused, and the host’s automation renews them well before the expiry date. The short life is only a problem if renewal is manual, which is exactly why automatic renewal is the first thing to check.
Free SSL vs paid SSL: is there a difference in security?
No. A free DV certificate and a paid DV certificate use the same encryption standards. Visitors see the same padlock, and the connection is just as private.
Where paid certificates differ is in the extras around the encryption, not the encryption itself:
| Feature | Free DV certificate | Paid certificates |
|---|---|---|
| Encryption strength | Standard modern TLS | Same standard modern TLS |
| Validation level | Domain only | Domain, or organization checks for OV and EV |
| Browser padlock | Yes | Yes |
| Typical lifetime | Short, renewed automatically | Longer, renewed on a billing cycle |
| Warranty from the issuer | Usually none | Often included |
| Cost | Included with the plan | A separate yearly fee |
Organization Validated (OV) and Extended Validation (EV) certificates add a check of the business behind the domain. Some companies need that for compliance or procurement reasons. For a business website, blog, portfolio or small online store, a free DV certificate does the job. Browsers no longer show a special green company name bar for EV certificates, so the visible difference for most visitors is gone.
What to check before you choose web hosting with free SSL
Before you buy, confirm five things: which domains are covered, whether renewal is automatic, whether HTTPS can be forced, how subdomains are handled, and what happens when you move your site in. These are the details a pricing table rarely spells out.
1. Every site and domain on the plan is covered
Check that free SSL applies to every website you can host on the plan, not just the first one. Also check that both versions of your address, example.com and www.example.com, are included. A certificate that covers only one of them leads to a browser warning on the other.
2. Renewal happens without you
Ask whether certificates renew automatically. If the answer involves a reminder email and a button you have to press, sooner or later someone will miss it, and visitors will see a full-page security warning instead of your site. Automatic renewal is the whole point of free SSL.
3. You can force HTTPS
Having a certificate isn’t the same as using it. Your site should redirect every http:// request to https://, so visitors and search engines only ever reach the secure version. Look for a setting in the control panel, or a simple way to add the redirect yourself.
4. Subdomains are handled
If you plan to run a shop on shop.example.com or a staging copy on a subdomain, check that those can get certificates too. Some hosts issue a certificate per subdomain automatically, others need you to add each one.
5. It works during a move
When you move a site to a new host, the certificate can usually only be issued once your domain points to the new server. Ask how the host handles that gap, so the site isn’t left without HTTPS for longer than it needs to be.
How to get HTTPS working once your hosting is set up
On a plan with free SSL, getting HTTPS working usually takes three steps: point your domain at the hosting, let the certificate issue, then make sure your site actually uses https:// everywhere.
- Point your domain. The certificate authority needs to see that the domain resolves to your hosting before it will issue a certificate. Our guide on pointing a domain to your hosting with nameservers or DNS records covers this step by step. DNS changes can take a while to spread, so give it time.
- Confirm the certificate is active. Open your site at https:// and click the padlock to see the certificate details, including the domain names it covers and the expiry date.
- Update your site’s own address. In WordPress, check that the WordPress Address and Site Address under Settings both start with https://. Other platforms have a similar base URL setting. If you are building a new WordPress site, our guide on how to host a WordPress website walks through the whole setup.
- Turn on the redirect. Force every HTTP request to HTTPS, so old links and bookmarks land on the secure version.
- Fix mixed content. If some images, scripts or stylesheets still load over http://, browsers may block them or drop the padlock. MDN’s page on mixed content explains what triggers this. Update the old URLs in your content and theme, or use a search-and-replace tool for the database.
If you are moving an existing site from HTTP to HTTPS, treat it like any other URL change: keep the redirects in place permanently and update your sitemap and analytics settings. Diligent Creators has a useful guide on changing a website without losing SEO rankings, and the same redirect habits apply here.
Common free SSL problems and how to fix them
Most SSL problems come from the domain not pointing to the right place, a missing www version, or mixed content inside the site. Very few are caused by the certificate itself.
- “Your connection is not private” on the www address. The certificate probably covers only one version of the domain. Ask your host to reissue it for both.
- The certificate won’t issue. Check that your DNS records point to the hosting and that no old record, such as an AAAA record pointing at a previous host, is sending the validation check somewhere else.
- The padlock is missing on some pages. That is almost always mixed content. Look in the browser’s developer console for http:// resources.
- Warnings after a certificate authority change. Occasionally a certificate authority is distrusted by browsers and certificates need replacing. My write-up on what developers need to update after a certificate authority incident shows what that looks like in practice. A host that runs automatic free SSL can replace affected certificates without you lifting a finger.
Does every ResellerBytes plan include free SSL?
Yes. Every ResellerBytes shared hosting plan, Starter, Business and Pro, includes free SSL on every site you host, along with email at your own domain and free website migration. Plans are billed annually.
Starter covers one website, Business covers three and Pro covers ten, so the free certificate scales with the number of sites on your plan. WordPress installs in one click and can go straight onto HTTPS. You can compare the plans side by side on our shared hosting plans page.
When I look at how people run into SSL trouble, it is rarely the certificate that fails. It is a renewal someone forgot, a www address nobody added, or a site that moved hosts and lost its padlock for a week. That’s why I think the useful question isn’t “is SSL free?” but “will I ever have to think about it?” If you are moving from another host, ask us about free website migration and we will move the site over for you.
Frequently asked questions
Is free SSL as secure as paid SSL?
Yes. Free and paid Domain Validated certificates use the same encryption, and browsers show the same padlock. Paid certificates add organization checks, longer billing cycles or a warranty, not stronger encryption.
Do I need to renew a free SSL certificate myself?
On good hosting, no. Free certificates have short lifetimes, so the host should renew them automatically before they expire. Check this before you buy, because manual renewal is the most common reason sites suddenly show security warnings.
Does free SSL cover the www version of my domain?
It should, but confirm it. A certificate needs to list both example.com and www.example.com. If only one is covered, visitors to the other address will see a warning.
Will HTTPS help my site in search results?
HTTPS is the expected standard for websites, and search engines and browsers both treat plain HTTP as less trustworthy. It won’t rank a weak page on its own, but running without it puts you behind.
When do I need a paid OV or EV certificate?
Mostly when a contract, regulator or procurement process asks for organization validation. For business sites, blogs, portfolios and small online stores, a free DV certificate is enough.
What happens to my SSL when I move hosts?
The new host issues a new certificate once your domain points to its servers. The old certificate stays with the old host. Plan the switch so the new certificate is active as soon as DNS changes take effect.
Share this content:
