SSL Certificates

SSL certificates encrypt the connection between your visitors' browsers and your server, protecting sensitive data and showing the padlock icon in the address bar. All Ultra Web Hosting accounts include free AutoSSL.

What is AutoSSL?

AutoSSL automatically issues and renews free SSL certificates for all domains on your hosting account. It runs periodically in the background, so in most cases your domains will have valid SSL certificates without you needing to do anything.

AutoSSL covers:

Your main domain (e.g., yourdomain.com)
The www subdomain (e.g., www.yourdomain.com)
Addon domains and their www subdomains
Subdomains you create in cPanel
Your webmail, cPanel, and webdisk subdomains

Checking Your SSL Status

Log into cPanel.
Scroll to the Security section.
Click SSL/TLS Status.
Review the list of domains. A green padlock icon means the certificate is active. A red or yellow icon means there is an issue.

Note After adding a new domain or subdomain, AutoSSL may take up to 24 hours to issue a certificate. You can click Run AutoSSL on the SSL/TLS Status page to trigger it sooner.

Common AutoSSL Issues

If AutoSSL fails to issue a certificate for a domain, the most common causes are:

DNS not pointing to our servers: The domain must resolve to your hosting account's IP address. If nameservers haven't been updated or propagated, AutoSSL cannot validate the domain.
CAA records blocking issuance: If your domain has CAA records, they must include the certificate authority used by AutoSSL (usually sectigo.com or letsencrypt.org).
.htaccess redirects: Certain redirect rules can interfere with the validation process. Temporarily renaming your .htaccess file can help diagnose this.
Domain expired or suspended: The domain must be active and resolving properly.

Forcing HTTPS with .htaccess

Even with an SSL certificate installed, visitors can still access your site over plain HTTP. To redirect all traffic to HTTPS, add the following rules to the .htaccess file in your domain's document root (usually public_html):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This issues a 301 permanent redirect, which tells browsers and search engines that your site should always be accessed over HTTPS.

Warning Only enable the HTTPS redirect after confirming your SSL certificate is active. Redirecting to HTTPS without a valid certificate will make your site inaccessible, as browsers will show a security error.

Forcing HTTPS in WordPress

For WordPress sites, in addition to the .htaccess redirect:

Log into your WordPress dashboard.
Go to Settings → General.
Change both WordPress Address (URL) and Site Address (URL) from http:// to https://.
Click Save Changes.

Tip If your WordPress site shows mixed content warnings (padlock with a warning triangle), some resources on your pages are still loading over HTTP. Use a plugin like Really Simple SSL to automatically fix mixed content issues, or use your browser's developer console to identify and update the specific URLs.

Installing a Third-Party SSL Certificate

If you have purchased an SSL certificate from another provider (such as an EV or OV certificate), you can install it manually:

In cPanel, go to Security → SSL/TLS.
Click Manage SSL sites under "Install and Manage SSL for your site."
Select the domain from the dropdown.
Paste your certificate (CRT), private key, and certificate authority bundle (CA Bundle) into the corresponding fields.
Click Install Certificate.