All our plans include a Let's Encrypt certificate, at no extra charge, issued and renewed without any action on your part. This guide explains what it does, what it does not do, and the two or three situations where it needs your attention.
What it does, what it does not do
| What the certificate guarantees | What it does not guarantee |
|---|---|
| That the link between the visitor and your site is encrypted | That the site's content is honest or up to date |
| That no one can read or alter the data in transit | That the site is safe from intrusion |
| That the visitor really is talking to the displayed domain | That the site is well maintained, backed up, or secured |
In other words: the certificate protects the journey, not the house. The security of the site itself is another subject — see Protecting your account and your access.
Why it is no longer optional
A site served in the clear is flagged as not secure by every current browser, as soon as a page contains an input field. Search engines penalize it. And an unencrypted contact form genuinely exposes what your visitors write in it.
What you have to do
Nothing. The certificate is issued automatically once the domain points correctly at your hosting, then renewed automatically before each expiry. There is no button to press, no reminder to note, no invoice to expect.
The one condition
The certificate can only be issued once the domain already points at our servers. That is a requirement of the certificate authority, not a rule of ours: it checks that the requester really controls the domain.
If you have just connected a domain, wait for propagation to finish. The certificate follows on its own.
Mixed content, the most frequent breakdown
Your site responds over https://, but the padlock appears crossed out or with a warning. In almost every case, the page is served encrypted but calls an image, a style sheet, or a script in the clear.
The usual causes:
- a site migrated from an old address, whose database still contains
http://links; - an image inserted with its full address rather than a relative path;
- a theme or extension calling an external resource in the clear.
The fix is to replace those calls with relative paths, or with the same address over https://. Most content management systems offer a replacement tool for the database.
Forcing the encrypted address
Once the certificate is in place, make http:// redirect to https://, so that no one lands on the clear version by accident. Most content management systems offer the option in their general settings. If yours does not, open a ticket: we will tell you the way to do it on your hosting.
If the https:// address remains at fault
| What you see | Most frequent cause |
|---|---|
| Security warning on a brand-new site | The domain was not yet pointed when issuance was attempted. Wait, then report it. |
| Crossed-out padlock, but the site displays | Mixed content: see above. |
| The warning concerns only a subdomain | The subdomain is not covered. Report it, naming it. |
| Only your browser complains, others do not | Local cache or a mis-set clock on the machine. |
In all unresolved cases, open a ticket stating the domain name and the exact address of the page that triggers the warning.