# WordPress.com HTTPS: SSL certificate pending, CAA and DNS > How WordPress.com issues free Let's Encrypt SSL, how to point a domain, which CAA value to allow, and how to fix SSL certificate pending. Source: https://ssl.sh/guides/wordpress-com-https/ Last updated: 2026-11-10 WordPress.com secures every site it hosts with a free Let's Encrypt certificate, provisioned and renewed automatically; HTTPS cannot be switched off. A new or newly connected domain usually gets its certificate within minutes and at most within 24 hours. If Domain security still says "SSL certificate pending", the domain's DNS does not point at WordPress.com correctly, or a CAA or DNSSEC record blocks issuance. Steps follow the WordPress.com support pages as of November 2026 and apply to sites hosted on WordPress.com, not self-hosted WordPress. ## How WordPress.com issues certificates Certificates are automatic and come from one CA. The support page states: "SSL certificates on WordPress.com come from the Let's Encrypt Certificate Authority." It covers all domains and subdomains hosted on WordPress.com, and adds: "The certificate usually takes a few minutes to provision, but it can take up to 24 hours." When you connect a domain, WordPress.com issues the free certificate automatically once the connection is active. WordPress.com supports TLS 1.2 and 1.3. There is nothing to buy: the support page describes SSL as something with nothing you need to buy or set up yourself. Renewal follows automatically as long as the domain keeps pointing at WordPress.com. ## Point your DNS at WordPress.com Use WordPress.com's nameservers unless other services already depend on your DNS host. Two methods are documented: - **Nameservers (recommended when the domain has no other services):** set the domain's nameservers at the registrar to `ns1.wordpress.com`, `ns2.wordpress.com` and `ns3.wordpress.com`. WordPress.com says "Your name servers should be set to only the three values listed above"; keeping one old nameserver alongside them causes the mixed name servers error below. - **DNS records (if you already use custom email or other services):** keep your DNS host and add the records from the connection screen: two A records on the root using "The first IP address shown on your connection screen" and "The second IP address shown on your connection screen", and a CNAME for `www` pointing to your domain name. Copy the A record values from your own connection screen rather than from a forum post; the help page deliberately does not hard-code them. DNS changes can take up to 72 hours to take effect. ## CAA records: allow Let's Encrypt If the domain has [CAA](https://ssl.sh/glossary/caa/) records, they must allow Let's Encrypt. WordPress.com's error text names the CA but not the record value; Let's Encrypt's CAA identifier is `letsencrypt.org`: ```text example.com. 3600 IN CAA 0 issue "letsencrypt.org" ``` If your domain uses WordPress.com nameservers, add the record under the domain's DNS records (CAA is one of the record types WordPress.com lets you add, described as controlling "which companies can create security certificates for your domain"). If DNS is elsewhere, add it there. A domain with no CAA records needs none. Check the result with the [CAA checker](https://ssl.sh/tools/caa-checker/) and see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/). ## When the certificate stays "SSL certificate pending" Open **Domains**, click the domain and look at **Domain security**. The status reads **"SSL certificate active"** or **"SSL certificate pending"**. When WordPress.com can tell why a certificate is not issuing, it shows one of these errors, quoted from the support page: - **CAA DNS records error:** "This domain has CAA DNS records that do not allow Let's Encrypt to issue a certificate. Please update or remove the CAA DNS records." - **Mixed name servers error:** "This domain has a mixture of both WordPress.com and external name servers. Please update the NS records." - **DNSSEC validation error:** "This domain has DNSSEC validation errors. You may need to remove or update the DS Record data at your registrar." Fix the cause, then click the **"Provision certificate"** button in Domain security to request a new certificate. If the button is missing, the domain is not set up correctly yet. The documented fixes by domain type: - **Domains registered with or transferred to WordPress.com:** turn on **Use WordPress.com name servers**, restore the default A and CNAME records from the three-dot menu in DNS records, wait a few hours, then provision. - **Connected domains:** finish the connection, and if you use WordPress.com nameservers, turn off DNSSEC (remove the DS record) at the registrar. If the site still shows "Not secure" after 24 hours, fix the DNS issue and provision manually. Visitors may see `NET::ERR_CERT_COMMON_NAME_INVALID` in the meantime because the served certificate does not cover the new domain yet; see [ERR_CERT_COMMON_NAME_INVALID](https://ssl.sh/errors/net-err-cert-common-name-invalid/). To check what the public DNS says: ```bash dig +short NS example.com dig +short A example.com dig +short CAA example.com dig +short DS example.com ``` ## HTTPS is forced and HSTS is on You do not need to force HTTPS, and you cannot turn it off. The support page states: "WordPress.com does not support disabling SSL. All insecure HTTP requests redirect to the secure HTTPS version." It also notes that "WordPress.com also sends a Strict-Transport-Security (HSTS) header with all HTTPS responses", so browsers that have visited once will refuse plain HTTP. See [HSTS](https://ssl.sh/glossary/hsts/) for what that means if you ever move the domain. ## Fix mixed content Mixed content on WordPress.com usually comes from Embed or Custom HTML blocks that load something over `http://`. WordPress.com's steps: 1. Open the page with the warning and open the browser console. 2. Reload and look for a warning or error that mentions mixed or insecure content. 3. Open the page or post in the editor and find the block containing the insecure address. 4. Replace `http://` with `https://` in the address, then click **Update**. 5. Clear the browser cache, reload and check for the padlock. If the resource does not load over HTTPS, upload the file to your WordPress.com site and use that copy instead. The [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/) finds the insecure URLs across a page in one pass; [mixed content warning](https://ssl.sh/errors/mixed-content-warning/) explains which ones browsers block. ## Can you upload your own certificate? No upload option exists. WordPress.com documents only its own Let's Encrypt certificates and presents SSL as included, with nothing to buy or install. If you need a certificate from a specific CA, for example an OV certificate required by a client, the site has to be hosted somewhere that accepts custom certificates. ## Verify Once Domain security shows the certificate as active, the domain and `www` should show Let's Encrypt as the issuer, matching names and a complete chain. Check them from outside: ```bash curl ssl.sh/example.com curl ssl.sh/www.example.com ``` The [SSL checker](https://ssl.sh/tools/ssl-checker/) shows the same report in a browser. ## Renewal and shorter lifetimes Renewal is automatic while the domain points at WordPress.com. Let's Encrypt stopped sending expiry reminder emails on June 4, 2025, its default certificates shorten from 90 to 64 days on February 10, 2027 and to 45 days on February 16, 2028, and public certificates are capped at 200 days since March 15, 2026. If a DNS change breaks renewal, nobody emails you; add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) for an outside check.