SSL Certificate Setup Done Properly, Without Breaking Your Site
An SSL certificate turns your site from HTTP to HTTPS and shows the padlock in the browser. Getting it installed is easy. Getting it right, with no warnings, no lost rankings and no surprise expiry, takes a little care.
How do I set up an SSL certificate for my website?
SSL certificate setup means getting a certificate for your domain, installing it on your server or hosting, and redirecting all HTTP traffic to HTTPS. You then fix mixed content, update links and sitemaps, set up automatic renewal, and test the site. Many hosts offer free certificates; paid ones add organisation checks and support.
Key takeaways
- Every website needs HTTPS, even sites without payments or logins.
- Free certificates encrypt just as well as paid ones for most sites.
- Redirect all HTTP pages to HTTPS with a single, permanent redirect.
- Fix mixed content so the padlock shows on every page.
- Set auto-renewal and an expiry alert so the site never shows a warning.
- Update Search Console, analytics and ads after moving to HTTPS.
What is an SSL certificate and why does every site need one?
An SSL certificate is a small data file that proves your domain's identity and lets the browser create an encrypted HTTPS connection. Every website needs one, because browsers mark HTTP sites as "Not secure" and visitors lose trust.
- Protects form data, logins and payments from being read or changed on the way
- Removes the "Not secure" label in Chrome, Edge, Safari and Firefox
- Google uses HTTPS as a light ranking signal
- Needed for modern browser features such as location access, service workers and HTTP/2 in browsers
- Builds trust on contact forms, WhatsApp click buttons and enquiry pages
HTTPS is one part of wider website security. It protects data on the way, but it does not stop malware, weak passwords or an old plugin.
Which SSL certificate do I need: DV, OV, EV or wildcard?
For most business websites, a Domain Validated (DV) certificate is enough. Choose OV or EV only if you need company details checked by the certificate authority, and a wildcard if you use many subdomains.
| Type | What is checked | Good for | Notes |
|---|---|---|---|
| DV (Domain Validated) | You control the domain | Most business sites, blogs, stores | Often free, issued in minutes |
| OV (Organisation Validated) | Domain plus company details | Companies that want verified details in the certificate | Takes days, paid |
| EV (Extended Validation) | Deeper company checks | Banks, large brands with policy needs | Browsers no longer show a green bar, so the visible benefit is small |
| Wildcard | Covers *.yourdomain.com | Many subdomains like shop., app., crm. | DV or OV; needs DNS validation |
| Multi-domain (SAN) | Several different domains in one | Groups of brand sites | Easier to manage one certificate |
Free certificate (e.g. Let's Encrypt)
- Same strong encryption
- Auto-renews on most hosts
- No cost
Paid certificate
- Adds organisation checks (OV/EV)
- Vendor support and warranty
- Longer manual renewal unless automated
How to set up an SSL certificate step by step
The SSL certificate setup steps are: pick a certificate, prove you control the domain, install it, redirect HTTP to HTTPS, fix mixed content and test. On most modern hosting, the first three steps take a few clicks.
- 1
Check your hosting options
Many hosts, cPanel panels, Cloudflare and platforms like Shopify and Wix offer free certificates. Check this first.
- 2
Validate the domain
The certificate authority checks control by a file on your site, a DNS record or an email to the domain admin.
- 3
Install the certificate
Your host may do it automatically. On a VPS, tools like Certbot install and renew Let's Encrypt certificates.
- 4
Include all versions
Cover both yourdomain.com and www.yourdomain.com, plus any subdomains in use.
- 5
Redirect HTTP to HTTPS
Add one permanent 301 redirect from every HTTP URL to the matching HTTPS URL, and pick one main version (www or non-www).
- 6
Update the site address
In WordPress, Laravel or your CMS, set the site URL to HTTPS so new links are generated correctly.
- 7
Fix mixed content
Find images, scripts and styles still loaded over HTTP and change them to HTTPS.
- 8
Test and monitor
Check the padlock on key pages, run an SSL test tool and set an expiry alert.
What is mixed content and how do I fix it?
Mixed content happens when an HTTPS page loads images, scripts or styles over plain HTTP. Browsers then block the files or hide the padlock. You fix it by changing those links to HTTPS or removing the files.
Where mixed content usually hides
- Old image links inside blog posts and product descriptions saved in the database
- Theme settings with a hard-coded HTTP logo or background
- Old tracking codes, chat widgets or embedded maps
- CSS files that load fonts or images over HTTP
- Links to your own files inside PDFs and emails (these do not break the padlock but should be updated)
Browser developer tools show mixed content warnings in the Console tab. We use a crawler to find them across all pages, not only the home page.
How to move from HTTP to HTTPS without losing Google rankings
To move from HTTP to HTTPS without losing rankings, use one permanent 301 redirect per page, update internal links and canonical tags, submit a new sitemap, and add the HTTPS property in Google Search Console. A short dip can happen, but traffic usually settles.
- Every HTTP URL redirects to the same path on HTTPS, not to the home page
- No redirect chains like http to https to www to final page
- Canonical tags and hreflang tags use HTTPS
- XML sitemap lists only HTTPS URLs
- HTTPS property added and verified in Google Search Console
- Google Analytics, Google Ads and Meta Ads landing URLs updated
- Google Business Profile website link updated
- Social profile links and email signature links updated
Official guidance on site moves is on Google Search Central.
Why do SSL certificates expire, and how do I stop expiry errors?
SSL certificates expire on purpose, so that keys are replaced regularly. To stop expiry errors, turn on automatic renewal and add an alert that warns you weeks before the end date.
Free certificates such as Let's Encrypt are valid for 90 days and are designed for auto-renewal. Paid certificates have also been getting shorter over time, and industry rules approved in 2025 will reduce maximum lifetimes in steps over the next few years. Manual renewal will get harder, so automation is the safe choice.
| Common cause of expiry error | Fix |
|---|---|
| Auto-renew failed because DNS moved to a new provider | Re-check validation method after any DNS change |
| Renewal worked, but server not reloaded | Add a reload step after renewal on VPS servers |
| Card on file expired for paid certificate | Update billing details and turn on reminders |
| Certificate on CDN and server out of sync | Check both Cloudflare/CDN and origin certificates |
| Subdomain forgotten | Keep a list of all domains and subdomains in use |
Our security monitoring service includes certificate expiry checks along with uptime and blocklist checks.
Extra HTTPS hardening: HSTS, TLS versions and headers
After SSL is working, add HSTS, turn off old TLS versions and set basic security headers. These steps make HTTPS harder to bypass and protect visitors further.
- Turn on HSTS with a short time first, then increase it once everything works on HTTPS
- Only add HSTS preload when every subdomain supports HTTPS, because it is hard to undo
- Disable TLS 1.0 and 1.1; allow TLS 1.2 and 1.3
- Add headers such as X-Content-Type-Options and a basic Content-Security-Policy
- Make cookies Secure and HttpOnly
A website firewall such as Cloudflare can also manage certificates and TLS settings at the edge.
Our SSL setup service: what is included and what affects cost
Our SSL setup service covers choosing the certificate, installation, HTTPS redirects, mixed content fixes, search and ads updates, and renewal monitoring. A single site is often done within a day.
- Number of domains and subdomains
- Hosting type: shared, VPS, cloud, Shopify, Wix or custom
- Amount of old HTTP content in the database
- Paid OV or EV certificate paperwork
- Whether a CDN or load balancer is involved
You get a clear quote after a free call. Our parent team, Shivah Web Tech, has 11+ years of experience across WordPress, Shopify, Wix, Laravel and custom builds. For a full check of your site, see our security audit, or contact us.
Related Pages
Website Security
Harden, update and protect your business website every day.
Security Monitoring
Alerts for downtime, file changes, logins and blacklists.
Website Firewall (WAF)
Block bad bots and common web attacks before they reach your site.
Security Audit
A clear report of your security gaps and how to fix them.
Frequently Asked Questions
Is a free SSL certificate good enough for a business website?
Yes, for most business websites. A free DV certificate such as Let's Encrypt gives the same encryption strength as a paid DV certificate. Choose a paid OV or EV certificate only if a client, tender or policy asks for verified company details inside the certificate.
Why does my site still say Not secure after installing SSL?
Usually the page loads some images, scripts or styles over HTTP, which is called mixed content. Another cause is visiting the HTTP version because the redirect is missing. Open the browser console to see which files are the problem, change them to HTTPS and add a permanent redirect.
How long does SSL certificate setup take?
On most modern hosting, a free certificate is issued and installed within minutes. A full HTTPS migration, including redirects, mixed content fixes and Search Console updates, usually takes a few hours to one working day for a normal business site. OV and EV certificates take longer because of company checks.
Does HTTPS make my website fully secure?
No. HTTPS protects data while it travels between the visitor and your server. It does not stop malware, hacked plugins, weak passwords or attacks on your server. You still need updates, strong logins, a firewall, backups and monitoring for full protection.
Will moving to HTTPS affect my SEO?
When done with proper 301 redirects, updated internal links and a new sitemap, moving to HTTPS should not hurt your SEO over time. There can be small changes for a few weeks while Google recrawls. HTTPS is also a light positive ranking signal.
What happens when an SSL certificate expires?
Browsers show a full-page security warning and most visitors leave. Forms, payments and some apps may stop working. Renew or reissue the certificate straight away, then set up automatic renewal and an expiry alert so it does not happen again.
Do I need a separate SSL certificate for each subdomain?
Not always. You can use a wildcard certificate that covers all first-level subdomains, a multi-domain certificate that lists several names, or separate free certificates per subdomain. The best choice depends on how many subdomains you have and how your hosting manages certificates.
Talk to our team today
Call or WhatsApp +91 85808 92163. We reply fast, Monday to Friday.