Best SSL certificate for WordPress

For almost every WordPress site the best SSL certificate is the free one your host provides. WordPress.com issues free Let's Encrypt certificates, cPanel's AutoSSL uses Let's Encrypt by default, and certbot does the same on a VPS. Pay only when your host cannot install a free certificate, Multisite needs a wildcard or multi-domain certificate, or someone requires your company name.

The cheapest paid DV certificate we verified on 10 November 2026 was Namecheap Standard SSL at $11.00 for the first year. Prices were copied from the sellers' own pages on that date. They change often, so the seller's checkout page is authoritative. Commissions never affect our recommendations.

Which certificate for which WordPress setup

A free DV certificate covers a single WordPress site; Multisite and organization requirements change the answer.

A paid certificate does not make WordPress itself more secure. It only changes who vouches for the domain and what extras (warranty, support, organization name) come with it.

Start with the free certificate from your host

Most hosts and servers already provide a free Let's Encrypt certificate:

• WordPress.com: its support page says it automatically provides free SSL certificates from Let's Encrypt for all domains and subdomains it hosts, and SSL cannot be disabled. Nothing to buy.
• Shared hosting with cPanel: AutoSSL installs domain-validated certificates automatically, and cPanel's documentation says the Let's Encrypt provider is used by default. See SSL on cPanel, or SSL on Plesk if your host uses Plesk.
• Your own VPS: run certbot or acme.sh with Nginx or Apache; see Nginx with Let's Encrypt and Apache with Let's Encrypt.

Let's Encrypt states that it does not charge for certificates, so the only reason to pay is a limitation of your host or a requirement for organization validation.

When a paid certificate makes sense for WordPress

Four situations justify paying for a WordPress certificate.

Your host offers no free certificate. If your hosting plan cannot install an ACME certificate and you cannot change host, buy the cheapest DV certificate you can install there: Namecheap Standard SSL at $11.00, PositiveSSL at $16.00 or RapidSSL at $18.65. You will have to reissue and reinstall it at least every 200 days.

WordPress Multisite on subdomains. Each new site gets a new subdomain, so a wildcard such as *.example.com covers sites you have not created yet. The cheapest paid DV wildcard was $84.00; a free Let's Encrypt wildcard needs the DNS-01 challenge and a DNS provider with an API. See cheapest wildcard SSL.

Multisite with domain mapping. Each mapped domain must be listed in a certificate. For a few domains, a multi-domain certificate works; for many, separate free certificates per domain are easier.

A partner requires OV or EV. A bank, payment provider or tender might ask for it. The cheapest OV certificate was Sectigo InstantSSL at $32.80, the cheapest EV Namecheap EV SSL at $76.99. Our e-commerce SSL guide covers shop requirements.

Switch WordPress to HTTPS properly

Installing the certificate is half the job; WordPress must also use https:// URLs.

1. Use Site Health. Since WordPress 5.7, Tools → Site Health checks whether your server supports HTTPS and offers a button that switches the site with a single click. It updates both the WordPress Address and the Site Address, and reverts if WordPress cannot load the site over HTTPS afterwards.
2. Let WordPress fix old links. After the switch, WordPress 5.7 and later replace insecure http:// URLs of your own site in content on the fly, as long as both addresses use the same domain.
3. Force HTTPS for logins. Add this to wp-config.php:

define( 'FORCE_SSL_ADMIN', true );

4. Redirect HTTP to HTTPS at the web server, as in redirect HTTP to HTTPS, and consider HSTS once everything works.
5. Find leftover mixed content such as hard-coded images or scripts with our mixed content scanner; see mixed content warnings.

Behind Cloudflare, a load balancer or another proxy

When a proxy terminates TLS and talks to WordPress over HTTP, WordPress thinks the request was insecure. With FORCE_SSL_ADMIN enabled this can cause an endless redirect loop. The WordPress documentation's fix is to trust the forwarded protocol header in wp-config.php:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
    $_SERVER['HTTPS'] = 'on';
}

Only do this if your server is reachable solely through the proxy, otherwise anyone can send the header. If you use Cloudflare, avoid the Flexible mode, which leaves the Cloudflare-to-origin connection unencrypted; see Cloudflare SSL vs a paid certificate.

Renewals: the hidden cost of paid certificates

Since 15 March 2026 a publicly trusted TLS certificate is valid for at most 200 days; the limit falls to 100 days on 15 March 2027 and 47 days on 15 March 2029. A paid "1-year" or "multi-year" certificate is a subscription that needs several reissues, each installed through your hosting panel. Free certificates from AutoSSL, WordPress.com or certbot renew without your involvement, which is the main reason they are the best choice for WordPress.