# Best SSL certificate for WordPress in 2026: free or paid?

> Which SSL certificate a WordPress site needs: free ones from your host, when to pay for wildcard, multi-domain or OV, and how to switch to HTTPS.

Source: https://ssl.sh/compare/best-ssl-for-wordpress/
Last updated: 2026-11-10

For almost every WordPress site the best SSL certificate is **the free one your host provides**. WordPress.com issues free Let's Encrypt certificates, cPanel's AutoSSL uses Let's Encrypt by default, and certbot does the same on a VPS. Pay only when your host cannot install a free certificate, Multisite needs a wildcard or multi-domain certificate, or someone requires your company name.

The cheapest paid DV certificate we verified on 10 November 2026 was **[Namecheap Standard SSL](https://ssl.sh/certificates/namecheap-standard-ssl/) at $11.00** for the first year. Prices were copied from the sellers' own pages on that date. They change often, so the seller's checkout page is authoritative. Commissions never affect our recommendations.

## Which certificate for which WordPress setup

A free DV certificate covers a single WordPress site; Multisite and organization requirements change the answer.

| Your setup | Certificate type | Cheapest verified paid option | Free alternative |
|---|---|---|---|
| One site (`example.com` + `www`) | DV | [Namecheap Standard SSL](https://ssl.sh/certificates/namecheap-standard-ssl/), $11.00 | Let's Encrypt via your host |
| Multisite on subdomains (`site1.example.com`) | Wildcard | [Sectigo EssentialSSL Wildcard](https://ssl.sh/certificates/essentialssl-wildcard/), $84.00 at GoGetSSL | Let's Encrypt wildcard via DNS-01 |
| Multisite with mapped domains (`example.net`) | Multi-domain | [Namecheap SAN Certificate](https://ssl.sh/certificates/namecheap-san-certificate/), $35.99 for three domains | One Let's Encrypt certificate per domain |
| WooCommerce shop | DV is enough unless a partner asks for more | As for one site | Let's Encrypt |
| Company site that must show the organization | OV | [Sectigo InstantSSL](https://ssl.sh/certificates/instantssl/), $32.80 at GoGetSSL | None (free CAs do not issue OV) |

A paid certificate does not make WordPress itself more secure. It only changes who vouches for the domain and what extras (warranty, support, organization name) come with it.

## Start with the free certificate from your host

Most hosts and servers already provide a free Let's Encrypt certificate:

- **WordPress.com:** its support page says it automatically provides free SSL certificates from Let's Encrypt for all domains and subdomains it hosts, and SSL cannot be disabled. Nothing to buy.
- **Shared hosting with cPanel:** AutoSSL installs domain-validated certificates automatically, and cPanel's documentation says the Let's Encrypt provider is used by default. See [SSL on cPanel](https://ssl.sh/guides/cpanel-ssl/), or [SSL on Plesk](https://ssl.sh/guides/plesk-ssl/) if your host uses Plesk.
- **Your own VPS:** run certbot or acme.sh with Nginx or Apache; see [Nginx with Let's Encrypt](https://ssl.sh/guides/nginx-lets-encrypt-certbot/) and [Apache with Let's Encrypt](https://ssl.sh/guides/apache-lets-encrypt-certbot/).

Let's Encrypt states that it does not charge for certificates, so the only reason to pay is a limitation of your host or a requirement for organization validation.

## When a paid certificate makes sense for WordPress

Four situations justify paying for a WordPress certificate.

**Your host offers no free certificate.** If your hosting plan cannot install an ACME certificate and you cannot change host, buy the cheapest DV certificate you can install there: Namecheap Standard SSL at $11.00, [PositiveSSL](https://ssl.sh/certificates/positivessl/) at $16.00 or [RapidSSL](https://ssl.sh/certificates/rapidssl/) at $18.65. You will have to reissue and reinstall it at least every 200 days.

**WordPress Multisite on subdomains.** Each new site gets a new subdomain, so a wildcard such as `*.example.com` covers sites you have not created yet. The cheapest paid DV wildcard was $84.00; a free Let's Encrypt wildcard needs the DNS-01 challenge and a DNS provider with an API. See [cheapest wildcard SSL](https://ssl.sh/compare/cheapest-wildcard-ssl/).

**Multisite with domain mapping.** Each mapped domain must be listed in a certificate. For a few domains, a [multi-domain certificate](https://ssl.sh/compare/cheapest-multi-domain-ssl/) works; for many, separate free certificates per domain are easier.

**A partner requires OV or EV.** A bank, payment provider or tender might ask for it. The cheapest OV certificate was Sectigo InstantSSL at $32.80, the cheapest EV Namecheap EV SSL at $76.99. Our [e-commerce SSL guide](https://ssl.sh/compare/best-ssl-for-ecommerce/) covers shop requirements.

## Switch WordPress to HTTPS properly

Installing the certificate is half the job; WordPress must also use `https://` URLs.

1. **Use Site Health.** Since WordPress 5.7, Tools → Site Health checks whether your server supports HTTPS and offers a button that switches the site with a single click. It updates both the WordPress Address and the Site Address, and reverts if WordPress cannot load the site over HTTPS afterwards.
2. **Let WordPress fix old links.** After the switch, WordPress 5.7 and later replace insecure `http://` URLs of your own site in content on the fly, as long as both addresses use the same domain.
3. **Force HTTPS for logins.** Add this to `wp-config.php`:

```php
define( 'FORCE_SSL_ADMIN', true );
```

4. **Redirect HTTP to HTTPS** at the web server, as in [redirect HTTP to HTTPS](https://ssl.sh/guides/redirect-http-to-https/), and consider [HSTS](https://ssl.sh/guides/enable-hsts/) once everything works.
5. **Find leftover mixed content** such as hard-coded images or scripts with our [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/); see [mixed content warnings](https://ssl.sh/errors/mixed-content-warning/).

## Behind Cloudflare, a load balancer or another proxy

When a proxy terminates TLS and talks to WordPress over HTTP, WordPress thinks the request was insecure. With `FORCE_SSL_ADMIN` enabled this can cause an endless redirect loop. The WordPress documentation's fix is to trust the forwarded protocol header in `wp-config.php`:

```php
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
    $_SERVER['HTTPS'] = 'on';
}
```

Only do this if your server is reachable solely through the proxy, otherwise anyone can send the header. If you use Cloudflare, avoid the Flexible mode, which leaves the Cloudflare-to-origin connection unencrypted; see [Cloudflare SSL vs a paid certificate](https://ssl.sh/compare/cloudflare-ssl-vs-paid-certificate/).

## Renewals: the hidden cost of paid certificates

Since 15 March 2026 a publicly trusted TLS certificate is valid for at most 200 days; the limit falls to 100 days on 15 March 2027 and 47 days on 15 March 2029. A paid "1-year" or "multi-year" certificate is a subscription that needs several reissues, each installed through your hosting panel. Free certificates from AutoSSL, WordPress.com or certbot renew without your involvement, which is the main reason they are the best choice for WordPress.