Hostinger SSL: install Lifetime SSL, fix failed installs and force HTTPS

Hostinger installs a free Lifetime SSL certificate automatically on every Web and Cloud hosting plan once a domain is added and points to Hostinger, normally within 1–2 hours. HTTPS is forced by default.

If the SSL page in hPanel shows Failed or stays on Installing, the cause is almost always DNS that does not reach Hostinger, a Cloudflare proxy, CAA records or an over-long domain name. Steps follow the Hostinger Help Center as of November 2026.

How Hostinger issues certificates

Lifetime SSL is automatic on shared plans. Hostinger states that it provides free SSL certificates on all Web and Cloud hosting plans and that "Lifetime SSL installs automatically once a domain is added to your hosting plan." Its troubleshooting article gives the expected time: Lifetime SSL installs automatically within 1–2 hours after you add a website, subdomain or parked domain, and failed attempts are retried automatically. Websites built with Hostinger's AI website builder get SSL after publishing, and SSL settings are not editable there. Wildcard certificates are only supported on VPS plans.

The help center does not name the certificate authority behind Lifetime SSL. Check the issuer of your live certificate with the SSL checker; you need that name if you publish CAA records.

Point your domain to Hostinger

The domain must resolve to your Hostinger hosting before the certificate can install. hPanel offers two ways:

• Nameservers: set the nameservers shown in hPanel at your registrar. Hostinger's examples look like example1.dns-parking.com and example2.dns-parking.com, but its docs warn that "Hostinger nameserver pairs differ per domain, so never guess one or copy it from another guide or domain."
• A records: choose Connect via DNS record and create A records for @ and www pointing to the hosting IP shown in hPanel, keeping your current DNS host.

Hostinger allows up to 24 hours for propagation. Keep only one A record for the domain: an old A record pointing elsewhere means validation may hit the wrong server.

CAA records

Hostinger's position is that Lifetime SSL does not need CAA records. The failed-install article says "Lifetime SSL does not require Certificate Authority Authorization (CAA) records", and its fix is to delete CAA records from the DNS zone. Hostinger's separate CAA article tells you to keep the default CAA records Hostinger creates, and for a custom SSL says "Both the tag and the CA domain should be provided by your certificate issuer."

So:

• No CAA records of your own: leave it that way.
• CAA records you added for another service and Lifetime SSL fails: delete them, as Hostinger instructs, or add a record for the CA that issued your Hostinger certificate.
• Custom SSL: add the CA domain your issuer documents, for example 0 issue "ssl.com" for SSL.com.

Check what is published with the CAA checker; CAA record prevents issuance explains how a CA evaluates the records.

When SSL shows Installing or Failed

Installing for up to two hours is normal; after that, work through Hostinger's checklist. The status is under Websites → Manage → Security → SSL, where Hostinger uses four values: Active, Installing, Inactive and Failed. The checklist:

1. DNS: the domain must point to Hostinger by nameservers or A record, and propagation must be complete.
2. Cloudflare: "temporarily set the A record to DNS only (bypass proxy) until the SSL installation completes", then re-enable the proxy once the certificate is Active.
3. One A record: remove extra A records for the same name.
4. CAA: delete CAA records, as described above.
5. Domain length: "The total length of the domain (including subdomains and extensions like .com) must be 64 characters or fewer." Longer names cannot get a certificate.
6. Reinstall: on the SSL page, open the ⋮ menu next to the domain, choose Uninstall, then install the SSL again.

Check DNS from outside before reinstalling:

dig +short NS example.com
dig +short A example.com
dig +short A www.example.com
dig +short CAA example.com

Two related errors have their own Hostinger articles. ERR_SSL_PROTOCOL_ERROR right after installation is fixed by uninstalling and reinstalling the SSL; see ERR_SSL_PROTOCOL_ERROR. ERR_TOO_MANY_REDIRECTS means two redirects fight each other: an .htaccess rule on top of Force HTTPS, a Cloudflare SSL mode that talks HTTP to the origin, or WordPress siteurl and home values that do not start with https.

Force HTTPS

On Web and Cloud plans HTTPS is already forced. Hostinger states: "As soon as an SSL certificate is installed on your website on any Web or Cloud hosting plan, HTTPS will be enabled (forced) by default." To change it, open Websites → Manage → SSL, click ⋮ next to the domain and choose Unforce HTTPS; choose Force HTTPS to turn it back on. "Forcing and unforcing HTTPS is not available on Agency Hosting plans." Do not add a second HTTPS redirect in .htaccess while Force HTTPS is on; that is a common cause of redirect loops. Hostinger's help center does not offer an HSTS switch; to add the header yourself, see enable HSTS.

Fix mixed content

Hostinger's mixed content guidance has two routes. The proper fix is to replace http:// with https:// in the site's configuration and content (for WordPress, the site URLs and stored links). The quick fix is a header in .htaccess that tells browsers to upgrade insecure requests:

Header always set Content-Security-Policy: upgrade-insecure-requests

Hostinger notes this header approach is not recommended if your site uses symlinks. The header only helps when the HTTPS version of each resource exists. Find the insecure URLs with the mixed content scanner and see mixed content warning.

Can you upload your own certificate?

Yes. Open Websites → Manage → Security → SSL, choose Import SSL, and paste the certificate, private key and CA bundle (CABUNDLE). The domain must not have an SSL installed at the time, so uninstall Lifetime SSL first. Custom SSL is not available for sites built with Hostinger's AI website builder, and Hostinger supports custom wildcard and multi-domain certificates only on VPS. Hostinger warns that an expired custom certificate combined with forced HTTPS makes the site inaccessible. With public certificates limited to 200 days since March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, a custom certificate needs a reinstall several times a year, while Lifetime SSL renews itself. Always include the CA bundle; see install an intermediate certificate.

Verify

Once the status is Active, the site should present a valid certificate and redirect HTTP to HTTPS. Test from outside:

curl ssl.sh/example.com
curl ssl.sh/www.example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'

The SSL checker shows the issuer, covered names, chain and expiry. Lifetime SSL renews automatically while DNS keeps pointing at Hostinger; add the domain to ssl.sh monitoring (in development) if you want an alert when that stops.