# GoDaddy SSL: AutoSSL, Managed WordPress, Websites + Marketing > Free SSL on GoDaddy cPanel (AutoSSL), Managed WordPress and Websites + Marketing: DNS, CAA, stuck certificates, HTTPS redirects, custom certs. Source: https://ssl.sh/guides/godaddy-ssl/ Last updated: 2026-11-10 GoDaddy includes free SSL on most current hosting products, and each product issues it differently. cPanel Web Hosting uses AutoSSL, Managed Hosting for WordPress uses an integrated SSL, and the Websites + Marketing builder installs a certificate when you publish. In all three, the certificate appears only once the domain points to GoDaddy and no CAA record blocks it. Steps follow the GoDaddy help center as of November 2026. ## How GoDaddy issues certificates Every current GoDaddy hosting product installs a free certificate automatically, but the mechanism differs by product: - **Web Hosting (cPanel) and Web Hosting Plus:** AutoSSL provides a "free, Domain Validated (DV) SSL certificate". GoDaddy lists it as available for Web Hosting (cPanel) Deluxe, Ultimate and Maximum plans and all Web Hosting Plus plans. AutoSSL scans daily and installs certificates automatically, renewing expired ones; there is no domain limit. - **Managed Hosting for WordPress:** the plan "comes with an integrated SSL certificate", activated when you attach a domain. GoDaddy says the activation can take up to 30 minutes. - **Websites + Marketing:** "As a GoDaddy Websites + Marketing customer on any plan, you get a free SSL certificate for your website." It installs automatically when the site is published. GoDaddy's help center does not say which certificate authority issues these free certificates. Run the [SSL checker](https://ssl.sh/tools/ssl-checker/) on the site to see the current issuer; you need that name for CAA. GoDaddy is also a CA itself ([GoDaddy](https://ssl.sh/cas/godaddy/)) and sells paid certificates, which have their own validation flow covered below. ## Point your DNS at GoDaddy The records depend on the product, but the rule is the same: the domain must resolve to the GoDaddy server that hosts the site. - **cPanel:** add an A record for `@` pointing to your cPanel IP and a CNAME for `www` pointing to the domain, removing conflicting records of the same type and name. The IP is in the hosting dashboard under **Settings → Server**. GoDaddy says DNS changes usually propagate within a few hours and can take up to 48 hours. - **Managed WordPress:** add the domain under the site's **Settings → Domains**. If the domain is in the same GoDaddy account, GoDaddy updates DNS for you; otherwise point the A record to the IP GoDaddy shows. A domain in another account or at another registrar may need domain ownership verification. - **Websites + Marketing:** connect the domain from **Settings** in the site editor and use the values the connect flow shows for your site. For AutoSSL, GoDaddy also requires that any existing certificate on the domain is expired or uninstalled; AutoSSL will not replace a valid certificate you installed yourself. ## CAA records: which CA to allow For certificates GoDaddy issues, CAA must list `godaddy.com` or `starfieldtech.com`. GoDaddy's CAA article says that "if godaddy.com or starfieldtech.com is listed on that record we will continue the issuance process", and that if another CA is listed, "we can not issue the certificate to you." No CAA record at all means issuance continues. ```text example.com. 3600 IN CAA 0 issue "godaddy.com" example.com. 3600 IN CAA 0 issue "starfieldtech.com" ``` That article covers GoDaddy-issued certificates. For the free AutoSSL, Managed WordPress and Websites + Marketing certificates GoDaddy does not publish a CAA value, and two help articles point at CAA as a cause of failure: Managed WordPress says "If your DNS has Certificate Authority Authorization (CAA) entries, you may need to delete those before the SSL installs", and the Websites + Marketing article says "Sometimes, your SSL certificate won't activate due to conflicting CAA records." The practical options are to remove [CAA](https://ssl.sh/glossary/caa/) records while the free SSL installs, or to add a record for the CA that issued your current certificate. Check the published records with the [CAA checker](https://ssl.sh/tools/caa-checker/). ## When the certificate is pending or will not activate Each product has its own recovery step for a pending certificate, and it fixes most cases: - **cPanel:** open **cPanel Admin → Security → SSL/TLS Status**, select the domains and click **Run AutoSSL**. A covered domain shows **AutoSSL Domain Validated** in the certificate status column. If a domain is not covered, check that its A record points to the hosting IP and that no other valid certificate is installed on it. - **Websites + Marketing:** GoDaddy's fix is to "simply republish your website", which "will force the system to restart the SSL certificate installation process from the beginning". GoDaddy adds: "After republishing, it takes up to 30 minutes for the SSL certificate to be activated." - **Managed WordPress:** allow up to 30 minutes after attaching the domain, remove CAA entries if present, and complete domain ownership verification if prompted. For paid GoDaddy certificates, the certificate shows **Pending Verification** under **SSL Certificates** until domain control is proven. GoDaddy's DNS method adds a TXT record at `@`; after adding it click **Check my update**, and "It can take 5-10 minutes for your verification to complete." If CAA blocks issuance, GoDaddy reports: "A DNS CAA record exists for domain(s) coolexample.com which forbids the issuance of this certificate." (the help center's placeholder domain). Its fix is to have the CAA record removed by your DNS provider, or to add `godaddy.com` as above. A SERVFAIL during the CAA lookup is typically caused by an outage at your authoritative nameserver. For the general mechanism, see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/). ```bash dig +short A example.com dig +short CAA example.com ``` ## Force HTTPS The redirect is a manual step on cPanel and automatic elsewhere. On cPanel, go to **cPanel Admin → Domains → Domains** and turn on **Force HTTPS Redirect** for each domain; GoDaddy notes that the site must have a valid SSL installed first. AutoSSL alone does not redirect visitors. On Managed WordPress, "The HTTPS redirect is automatically enabled after the SSL certificate install finishes." To add [HSTS](https://ssl.sh/glossary/hsts/) on cPanel, follow [enable HSTS](https://ssl.sh/guides/enable-hsts/) once every subdomain has a working certificate. ## Fix mixed content GoDaddy's guidance for WordPress sites (cPanel or Managed WordPress) is the Really Simple SSL plugin: install it, tick **Mixed Content Fixer**, and if pages still break, try the "Mixed content fixer - init hook" or back-end options. The plugin rewrites `http://` references on the fly; it is better to fix the stored URLs as well (site address under **Settings → General** and old URLs in posts) so the site does not depend on the plugin. Find the remaining offenders with the [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/) and read [mixed content warning](https://ssl.sh/errors/mixed-content-warning/). ## Can you upload your own certificate? Yes on cPanel, Plesk, VPS and dedicated servers; no on Managed WordPress and Websites + Marketing. GoDaddy's third-party SSL article lists third-party certificates as supported on Web Hosting (cPanel), Windows (Plesk), VPS and dedicated servers, meaning you install them yourself; Managed Hosting for WordPress is "Not supported", and Websites + Marketing likewise. On cPanel, exclude the domain from AutoSSL in **SSL/TLS Status** first so AutoSSL does not overwrite your certificate, then install it as described in the [cPanel SSL guide](https://ssl.sh/guides/cpanel-ssl/), including the CA bundle ([install an intermediate certificate](https://ssl.sh/guides/install-intermediate-certificate/)). With public certificates capped at 200 days since March 15, 2026 and 100 days from March 15, 2027, plan for at least two reinstalls a year. Let's Encrypt can also be installed by hand on cPanel, but GoDaddy states that it "does not support auto-install on Web Hosting (cPanel) accounts", so on plans with AutoSSL, AutoSSL is the low-maintenance choice. ## Verify Both the domain and `www` should present a valid certificate. Check them from outside: ```bash curl ssl.sh/example.com curl ssl.sh/www.example.com curl -sI http://example.com | grep -iE '^(HTTP|location)' ``` The [SSL checker](https://ssl.sh/tools/ssl-checker/) gives the same report in a browser: the issuer, the names covered, a complete chain and a future expiry date. Free certificates renew while DNS stays pointed at GoDaddy; for an outside alert if renewal stops, add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development).