Wix SSL certificates: connecting a domain, CAA records and fixing "not secure"

Wix generates an SSL certificate automatically once a domain is connected, normally within 48 hours of updating DNS. You do not request, install or renew anything, and HTTPS cannot be turned off.

When a site still shows as not secure, the cause is usually wrong DNS records, DNSSEC, a CAA record, or http:// code inside an embed. Steps and screen names follow the Wix Help Center as of November 2026.

How Wix issues certificates

Wix creates the certificate as soon as it sees the domain pointing at your site. The Help Center says "Once you connect your domain, the SSL certificate will automatically be generated" and that "Wix automatically generates a certificate for each custom domain and subdomain connected to your site." Its domain assistant gives the timing: "The SSL certificate is automatically generated within 48 hours of updating your DNS records."

Wix's general SSL articles do not name the certificate authority. Its Enterprise custom-certificate article does: when a custom certificate is about to expire, Wix issues a new certificate for the domain "through Let's Encrypt or Google". Expect either Let's Encrypt or Google Trust Services as the issuer when you check the site. One limit to note: Wix does not provide SSL for domains or subdomains connected to external, non-Wix websites.

Point your DNS at Wix

Wix offers two connection methods: name servers or pointing. With the name servers method you replace the nameservers at your registrar with the ones Wix shows; the help center says to "replace them with the Wix name servers shown on the screen", because the pair differs per account. Wix then manages all DNS records. With the pointing method you keep your DNS host and add two records:

Remove other A records on the root and any old www record. Wix states that it "does not support the use of Domain Name System Security Extensions (DNSSEC) or DNS Proxies like Cloudflare for domains connected by pointing", so switch DNSSEC off at the registrar and set any Cloudflare records to DNS only. For a domain bought from Wix, the DNS records are under Domains → Domain Actions → Manage DNS Records, where you can also reset them to the defaults.

If you move a Wix-registered domain to custom nameservers, Wix warns that it "can no longer renew your site's SSL certificate through your domain's DNS, so check your SSL status after the change."

CAA records: remove them, or allow Let's Encrypt and Google

Wix's guidance is to remove CAA records from pointed domains. A Wix feature-request article states "Currently, CAA records are not supported by Wix" and asks owners who connected by pointing to remove existing CAA records at their domain host. The Enterprise article adds the reason: Wix cannot issue its replacement certificate if the domain has a CAA record "that doesn't list Let's Encrypt or Google as permitted issuers."

If you must keep CAA records for other services, the safe set allows both CAs Wix names:

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issue "pki.goog"

letsencrypt.org is Let's Encrypt's CAA identifier and pki.goog is Google Trust Services'. Wix does not publish these strings itself, so removing the records remains the option Wix supports. Check what is published with the CAA checker and see CAA record prevents issuance.

When the site is not secure

Wix does not document a "pending" label for SSL; you troubleshoot by symptom. The Help Center's troubleshooting article has four steps, quoted by heading:

1. "Make sure your DNS records are correct": for pointing, @ → 185.230.63.107 and www → pointing.wixdns.net; for the name servers method, confirm the nameservers at your registrar. Reset Wix-managed records to the defaults if they were edited.
2. "Wait until your domain has propagated": allow up to 48 hours after any DNS change.
3. "Ensure that DNSSEC is not signed": for domains bought outside Wix, ask the registrar to confirm DNSSEC is off. Wix domains are already unsigned.
4. "Ensure only HTTPS code is entered in the HTML element": otherwise the browser reports that the site is "not fully secure" (see the mixed content section).

Wix also notes that "Older operating systems can sometimes fail to recognise a modern SSL Certificate". If only one old device complains, update it; the site's certificate is not at fault. To see what the public DNS returns:

dig +short A example.com
dig +short CNAME www.example.com
dig +short CAA example.com
dig +short DS example.com

An empty DS answer means DNSSEC is not active at the registrar.

HTTPS is always on

Wix forces HTTPS for you, and you cannot switch it off. The Help Center states that "All new sites created on Wix have HTTPS automatically enabled", served over TLS 1.2 and above, and that it is not possible to manually disable an SSL certificate for a Wix site. Wix's help center does not document an HSTS option; run the domain through the HSTS checker if you need to know whether the header is sent.

Fix mixed content

On Wix, mixed content almost always comes from an HTML element (embed). Wix's fix: open the element in the Editor, click Edit Code, remove any http:// code or replace it with https://, then publish. Repeat for each HTML element on the site. Embedded widgets, iframes, tracking pixels and images pasted from other servers are the usual offenders; if a third-party resource has no HTTPS version, replace or remove it.

Use the mixed content scanner to list the insecure URLs on each page, and see mixed content warning for how browsers treat them.

Can you upload your own certificate?

Only on Wix Enterprise. "Custom SSL certificates are available on Enterprise accounts only, and need to be enabled for your account." The certificate must cover two names only, the domain and its www version, with a private key of 2048 bits or shorter and at least 3 months of validity remaining. Install it from Domains → Domain Actions → Install SSL certificate; if the Domains page has no SSL certificate column, the feature is not enabled. About 20 days before a custom certificate expires, Wix issues its own certificate through Let's Encrypt or Google, unless a CAA record blocks it. With public certificates capped at 200 days since March 15, 2026 and 100 days from March 15, 2027, a custom certificate means a manual reinstall at least twice a year.

Verify

Once DNS has propagated, both hostnames should show Let's Encrypt or Google Trust Services as the issuer (or your CA on Enterprise), with matching names and a complete chain. Test them from outside:

curl ssl.sh/example.com
curl ssl.sh/www.example.com

Or use the SSL checker. Wix renews its own certificates automatically while DNS keeps pointing at Wix; after any DNS change, recheck, and add the domain to ssl.sh monitoring (in development) to catch an expiry you would otherwise not hear about.