# Bluehost SSL: free Let's Encrypt, AutoSSL fixes, force HTTPS

> How Bluehost's free Let's Encrypt SSL works via AutoSSL, which CAA value to allow, how to fix a Not secure status and how to force HTTPS.

Source: https://ssl.sh/guides/bluehost-ssl/
Last updated: 2026-11-10

Bluehost's free SSL is a Let's Encrypt certificate that AutoSSL issues and renews. Once the domain points to Bluehost, it is usually active within minutes of switching it on. Bluehost does not redirect visitors to HTTPS, so you add the redirect yourself.

If the SSL card says the certificate is not secure, read the SSL logs, correct DNS and run AutoSSL again. Steps follow the Bluehost help center as of November 2026, and menu names follow the current Bluehost portal.

## How Bluehost issues certificates

Bluehost uses cPanel's AutoSSL with Let's Encrypt. Its AutoSSL article states that "AutoSSL utilizes trusted Let's Encrypt certificates" and that it "automatically renews your certificates before they expire." The activation guide says enabling the free SSL "may take a few minutes." In the portal, the free certificate shows as **Basic**: "If you see Basic, your site is currently using the Free SSL, Let's Encrypt."

How you turn it on depends on the site:

- **WordPress sites:** open **Websites** (My Sites), click **Manage Site**, open the **Security** tab and switch on **SSL Certificate: Let's Encrypt**.
- **Other sites:** open **Marketplace**, choose **SSL Certificate**, pick the domain under **Install SSL On:** and click **Enable Free SSL**.

## Point your domain to Bluehost

AutoSSL validates the domain over the internet, so the domain must resolve to your Bluehost server. Bluehost's default nameservers are `ns1.bluehost.com` and `ns2.bluehost.com`; Bluehost says nameserver changes "can take up to 24–48 hours to propagate globally". If you keep DNS at another provider, Bluehost's instruction is to "create an A record in your provider's DNS and link the domain to Bluehost to activate the Free SSL", using the IP of your hosting account. Add the same for `www`, or a CNAME to the root, so both names validate.

## CAA records: allow letsencrypt.org

If your domain has [CAA](https://ssl.sh/glossary/caa/) records, they must allow Let's Encrypt. Bluehost's help center does not give a CAA value, but because the free SSL comes from Let's Encrypt, the identifier to allow is `letsencrypt.org`, as documented by Let's Encrypt:

```text
example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
```

Add it next to any CAA records you keep for other services. If you later install a certificate from another CA, add that CA too. Check the published records with the [CAA checker](https://ssl.sh/tools/caa-checker/); a CAA block looks like [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/) in the AutoSSL log.

## When the SSL card says "not secure"

Fix a **Not secure** status by reading the AutoSSL log and running AutoSSL again. The SSL card in the site's **Security** tab shows either **"SSL Certificate is secure."** or **"SSL Certificate is not secure."**, and the status reads **Not secure** when no valid certificate is in place. Bluehost's steps:

1. Click the vertical ellipsis on the SSL card and select **View SSL logs**. This opens cPanel's SSL/TLS overview and the AutoSSL log, which names the reason a domain failed.
2. Select the domain and click **Run AutoSSL**.
3. If the domain was excluded from AutoSSL, click **+ Include during AutoSSL** first, then **Run AutoSSL** again. Bluehost confirms with "Success: The following domains have had their AutoSSL exclusion removed:".
4. After a successful run, the domain shows **AutoSSL Domain Validated**.

If the log reports a validation failure, the domain did not resolve to Bluehost or the validation request was blocked: fix the A record or nameservers, remove any CDN proxy during validation, check CAA, and run AutoSSL again. Confirm what public DNS returns first:

```bash
dig +short NS example.com
dig +short A example.com
dig +short A www.example.com
dig +short CAA example.com
```

cPanel's AutoSSL also runs on a regular schedule, so after a fresh nameserver change you can wait for propagation instead of running it repeatedly. Repeated failed requests against Let's Encrypt can hit its limits; see [Let's Encrypt rate limits](https://ssl.sh/errors/lets-encrypt-rate-limit/).

## Force HTTPS

You have to add the redirect yourself. Bluehost states: "The Free SSL does not automatically enforce HTTPS on your domain or subdomain; it must be activated manually." Bluehost's guide to forcing SSL uses `.htaccess`, edited in **Hosting → File Manager** (enable **Show Hidden Files**):

```apache
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
```

Put the rule above the WordPress block if the site runs WordPress, and set both addresses under WordPress **Settings → General** to `https://`. More variants are in [redirect HTTP to HTTPS](https://ssl.sh/guides/redirect-http-to-https/). Bluehost's help center has no HSTS switch; once everything works over HTTPS you can add the header as described in [enable HSTS](https://ssl.sh/guides/enable-hsts/).

## Fix mixed content

Mixed content stays after the certificate is active whenever pages still reference `http://` URLs. Bluehost's advice is to update internal links to HTTPS or relative URLs. On WordPress the common sources are the site address settings, URLs stored in posts and page-builder data, theme options and hard-coded assets in the theme; change them with a database search-and-replace from `http://example.com` to `https://example.com`, then clear any caching plugin.

Scan the main pages with the [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/) and read [mixed content warning](https://ssl.sh/errors/mixed-content-warning/) for which resources browsers block.

## Can you upload your own certificate?

Yes. In **Websites → Manage Site → Security**, the **SSL Certificates** card's ellipsis menu offers **Generate CSR**, **Upload SSL** and **View SSL Logs**. Generate the CSR there or with the [CSR generator](https://ssl.sh/tools/csr-generator/), buy the certificate, then upload the certificate, private key and CA bundle. AutoSSL does not renew a certificate you uploaded. Public certificates have been capped at 200 days since March 15, 2026 and the cap falls to 100 days on March 15, 2027 and 47 days on March 15, 2029, so an uploaded certificate needs replacing several times a year; the free Let's Encrypt certificate renews itself. See [install an intermediate certificate](https://ssl.sh/guides/install-intermediate-certificate/) if browsers complain about the chain.

## Verify

The free certificate shows Let's Encrypt as the issuer and covers both `example.com` and `www.example.com`. Once the card shows the certificate as secure, check from outside:

```bash
curl ssl.sh/example.com
curl ssl.sh/www.example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'
```

The [SSL checker](https://ssl.sh/tools/ssl-checker/) shows the issuer (Let's Encrypt for the free SSL), covered names, chain and expiry. Let's Encrypt stopped sending expiry emails on June 4, 2025, and its default certificates shorten to 64 days on February 10, 2027 and 45 days on February 16, 2028, so a silent AutoSSL failure turns into an expired certificate sooner. Add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) for an outside alert.