Checking your free SSL certificate in cPanel

Open SSL/TLS Status in cPanel to check your certificate, and if it shows as issued but the site still says "not secure", the fix is almost always turning on Force HTTPS Redirect on the Domains page or clearing old http:// links out of the WordPress database.

Before you start

• Your domain's DNS needs to be pointing at Hostworld already: AutoSSL cannot issue a certificate until it can validate the domain against our server.
• If you use Cloudflare or another proxy in front of the site, it needs to be set to "DNS Only" (grey cloud), not proxied, or validation will fail.
• Have your WordPress admin login to hand for the mixed-content steps later on.

Step 1: Check the certificate in cPanel

Log in to cPanel, search for SSL/TLS Status and open it. This screen lists every domain on the account with its certificate type, expiry date and any error from the last AutoSSL check. Click a domain's name to view the certificate detail, including its expiry date.

If the domain shows no certificate or an error rather than a valid one, click Run AutoSSL to force a fresh check and issue. AutoSSL uses a free Sectigo or Let's Encrypt certificate and normally issues within a few hours once DNS is pointed correctly. If you've only just switched your domain's nameservers to Hostworld, allow up to 24 to 48 hours for that DNS change to propagate before AutoSSL can validate the domain.

Step 2: Force HTTPS once the certificate is issued

Once SSL/TLS Status shows a valid certificate for the domain, go to Domains in cPanel and find the domain in the list. Toggle Force HTTPS Redirect to on. This option only becomes available once a certificate is actually installed, which is why it needs to come after Step 1, not before.

If the toggle isn't present in your cPanel theme, add a redirect rule to the .htaccess file in your site's document root instead (normally public_html, reachable via File Manager in cPanel). This is a fallback for older interfaces; Force HTTPS Redirect is the supported method and should be tried first.

Step 3: Fix mixed content in WordPress

If the padlock still shows a warning after Step 2, it's almost always old http:// links stored in the WordPress database, not the certificate. Back up your site and database first: this matters because the next step touches serialized data and a bad run can corrupt theme, widget and plugin settings across the whole site.

1. In wp-admin, go to Settings > General and check that both WordPress Address (URL) and Site Address (URL) read https://, not http://.
2. Install a search-and-replace tool that handles WordPress's serialized data correctly, such as the Better Search Replace plugin, rather than editing the database by hand. Run it in dry run mode first to see how many rows it will change.
3. Once the dry run looks right, run it for real, replacing http://yourdomain.com with https://yourdomain.com across the database.
4. Clear any caching plugin or CDN cache, then hard-refresh the pages that were showing the warning.

If it does not work

• AutoSSL stays pending or errors repeatedly. Check for a CAA record on the domain: if one exists and doesn't list your certificate authority, it will block issuance until removed or updated. Also check you haven't hit Let's Encrypt's limit of five failed validation attempts per hour, which forces a wait.
• One warning left after the database is clean. This is usually a third-party embed you don't control, such as an ad script or an external font, still loading over http://. Update or remove that specific reference; your own site is clean at that point.
• Mixed content appears alongside odd redirects, unknown admin users or spam pages. Don't treat this as routine SSL housekeeping. Scan the site for compromise before doing anything else.

What next

For the fuller picture of how AutoSSL, forced HTTPS and mixed content fit together, and the other routes to a working certificate, see our guide to fixing a "not secure" warning. If AutoSSL still won't issue after checking DNS and CAA records, open a support ticket and we'll check it from our side.