How to fix or renew your SSL certificate

What the checkup result means

One background fact worth knowing: public certificates are getting shorter lives. Since March 2026 the maximum is 200 days, and the industry schedule keeps shortening it over the next few years. Free certificates like Let's Encrypt already last about 90 days. Manual renewal once a year is over. Automatic renewal is the only setup that holds up.

cPanel hosting (AutoSSL and Let's Encrypt)

Many cPanel hosts include a free certificate that renews itself, through a feature called AutoSSL, often using Let's Encrypt or a similar free provider.

1. Sign in to cPanel and open SSL/TLS Status (in the Security section).
2. Look at your domains. Each one shows whether it has a valid certificate. Make sure both yourdomain.com and www.yourdomain.com are listed and checked.
3. Click "Run AutoSSL". It requests fresh certificates for every name it can verify.
4. If a name fails, the status page usually says why. The most common reason is DNS: the name points somewhere other than this server, or the www record is missing. Fix the DNS record, then run AutoSSL again.

If you do not see SSL/TLS Status or AutoSSL, your host may not offer it on your plan. Ask them whether a free automatic certificate is available before buying one.

GoDaddy managed SSL

If you bought a certificate from GoDaddy, check two things in your GoDaddy account under SSL certificates: that the certificate's term is still active, and whether GoDaddy installs it for you or you installed it yourself. If GoDaddy manages the installation, contact GoDaddy support to renew and reinstall it. If you installed it yourself on cPanel, renewing the purchase is not enough. You also have to download the renewed certificate and install it under SSL/TLS in cPanel. If your hosting offers free AutoSSL, that is often the simpler long-term choice.

Wix, Squarespace, Shopify and other platforms

Website platforms issue and renew certificates for you. If the checkup flags a problem on one of these, it is almost always DNS:

• Your domain's records do not point to the platform exactly the way it asks (a common case is a missing or wrong www record), so it cannot issue the certificate.
• An old record from a previous host is still there and sending some visitors to the wrong place.

Open the domain section of your platform account. Most show a connection status and the exact records they expect. Make your DNS match, wait a little, and the platform will issue the certificate. If the status says everything is connected and the warning remains, contact the platform's support.

Using Cloudflare in front of your site? Set its SSL mode to "Full (strict)" so the connection is encrypted all the way to your host, and make sure your host also has a valid certificate.

Forcing HTTPS (redirect HTTP to HTTPS)

A valid certificate is half the job. Anyone who types your address without https://, or follows an old link, should be sent to the secure version automatically.

• cPanel: many hosts have a "Force HTTPS Redirect" switch on the Domains page. Use it if you see it.
• WordPress: under Settings, then General, make sure both addresses start with https://. Back up first.
• Platforms: look for an "HTTPS" or "secure connection" setting and turn it on. Many platforms do this by default.
• Cloudflare: turn on "Always Use HTTPS" under SSL/TLS, and skip the .htaccess snippet below to avoid redirect loops.

On Apache or cPanel hosts without a switch, back up your .htaccess file (see the security headers guide for how) and add this at the top:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Then test: type your address with http:// in a private window. You should land on the https:// version. If the page keeps reloading or shows "too many redirects", remove the snippet and put your backup back; something else (often a proxy or plugin) is already redirecting.

Once HTTPS works everywhere, consider adding the HSTS header from the security headers guide.