Bluehost SSL: enable free Let's Encrypt, fix AutoSSL and force HTTPS

Bluehost's free SSL is a Let's Encrypt certificate that AutoSSL issues and renews. Once the domain points to Bluehost, it is usually active within minutes of switching it on. Bluehost does not redirect visitors to HTTPS, so you add the redirect yourself.

If the SSL card says the certificate is not secure, read the SSL logs, correct DNS and run AutoSSL again. Steps follow the Bluehost help center as of November 2026, and menu names follow the current Bluehost portal.

How Bluehost issues certificates

Bluehost uses cPanel's AutoSSL with Let's Encrypt. Its AutoSSL article states that "AutoSSL utilizes trusted Let's Encrypt certificates" and that it "automatically renews your certificates before they expire." The activation guide says enabling the free SSL "may take a few minutes." In the portal, the free certificate shows as Basic: "If you see Basic, your site is currently using the Free SSL, Let's Encrypt."

How you turn it on depends on the site:

• WordPress sites: open Websites (My Sites), click Manage Site, open the Security tab and switch on SSL Certificate: Let's Encrypt.
• Other sites: open Marketplace, choose SSL Certificate, pick the domain under Install SSL On: and click Enable Free SSL.

Point your domain to Bluehost

AutoSSL validates the domain over the internet, so the domain must resolve to your Bluehost server. Bluehost's default nameservers are ns1.bluehost.com and ns2.bluehost.com; Bluehost says nameserver changes "can take up to 24–48 hours to propagate globally". If you keep DNS at another provider, Bluehost's instruction is to "create an A record in your provider's DNS and link the domain to Bluehost to activate the Free SSL", using the IP of your hosting account. Add the same for www, or a CNAME to the root, so both names validate.

CAA records: allow letsencrypt.org

If your domain has CAA records, they must allow Let's Encrypt. Bluehost's help center does not give a CAA value, but because the free SSL comes from Let's Encrypt, the identifier to allow is letsencrypt.org, as documented by Let's Encrypt:

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

Add it next to any CAA records you keep for other services. If you later install a certificate from another CA, add that CA too. Check the published records with the CAA checker; a CAA block looks like CAA record prevents issuance in the AutoSSL log.

When the SSL card says "not secure"

Fix a Not secure status by reading the AutoSSL log and running AutoSSL again. The SSL card in the site's Security tab shows either "SSL Certificate is secure." or "SSL Certificate is not secure.", and the status reads Not secure when no valid certificate is in place. Bluehost's steps:

1. Click the vertical ellipsis on the SSL card and select View SSL logs. This opens cPanel's SSL/TLS overview and the AutoSSL log, which names the reason a domain failed.
2. Select the domain and click Run AutoSSL.
3. If the domain was excluded from AutoSSL, click + Include during AutoSSL first, then Run AutoSSL again. Bluehost confirms with "Success: The following domains have had their AutoSSL exclusion removed:".
4. After a successful run, the domain shows AutoSSL Domain Validated.

If the log reports a validation failure, the domain did not resolve to Bluehost or the validation request was blocked: fix the A record or nameservers, remove any CDN proxy during validation, check CAA, and run AutoSSL again. Confirm what public DNS returns first:

dig +short NS example.com
dig +short A example.com
dig +short A www.example.com
dig +short CAA example.com

cPanel's AutoSSL also runs on a regular schedule, so after a fresh nameserver change you can wait for propagation instead of running it repeatedly. Repeated failed requests against Let's Encrypt can hit its limits; see Let's Encrypt rate limits.

Force HTTPS

You have to add the redirect yourself. Bluehost states: "The Free SSL does not automatically enforce HTTPS on your domain or subdomain; it must be activated manually." Bluehost's guide to forcing SSL uses .htaccess, edited in Hosting → File Manager (enable Show Hidden Files):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Put the rule above the WordPress block if the site runs WordPress, and set both addresses under WordPress Settings → General to https://. More variants are in redirect HTTP to HTTPS. Bluehost's help center has no HSTS switch; once everything works over HTTPS you can add the header as described in enable HSTS.

Fix mixed content

Mixed content stays after the certificate is active whenever pages still reference http:// URLs. Bluehost's advice is to update internal links to HTTPS or relative URLs. On WordPress the common sources are the site address settings, URLs stored in posts and page-builder data, theme options and hard-coded assets in the theme; change them with a database search-and-replace from http://example.com to https://example.com, then clear any caching plugin.

Scan the main pages with the mixed content scanner and read mixed content warning for which resources browsers block.

Can you upload your own certificate?

Yes. In Websites → Manage Site → Security, the SSL Certificates card's ellipsis menu offers Generate CSR, Upload SSL and View SSL Logs. Generate the CSR there or with the CSR generator, buy the certificate, then upload the certificate, private key and CA bundle. AutoSSL does not renew a certificate you uploaded. Public certificates have been capped at 200 days since March 15, 2026 and the cap falls to 100 days on March 15, 2027 and 47 days on March 15, 2029, so an uploaded certificate needs replacing several times a year; the free Let's Encrypt certificate renews itself. See install an intermediate certificate if browsers complain about the chain.

Verify

The free certificate shows Let's Encrypt as the issuer and covers both example.com and www.example.com. Once the card shows the certificate as secure, check from outside:

curl ssl.sh/example.com
curl ssl.sh/www.example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'

The SSL checker shows the issuer (Let's Encrypt for the free SSL), covered names, chain and expiry. Let's Encrypt stopped sending expiry emails on June 4, 2025, and its default certificates shorten to 64 days on February 10, 2027 and 45 days on February 16, 2028, so a silent AutoSSL failure turns into an expired certificate sooner. Add the domain to ssl.sh monitoring (in development) for an outside alert.