SSL Certificates: Essential Features for Your Hosting

Browsers trained everyone to look for a padlock. Hosts trained everyone to sell SSL as an add-on. In 2026, Let’s Encrypt or an equivalent automated DV cert is how Bluehost, SiteGround, Cloudways, and Cloudflare should behave on day one. The remaining decisions are wildcards, how Cloudflare talks to origin, and the mixed-content mess after you force HTTPS.

Domain-validated certificates prove you control the hostname, not that your business is virtuous. Let’s Encrypt, AutoSSL in cPanel, and host dashboards at SiteGround, WP Engine, Kinsta, and Cloudways issue them for free and renew them. Paying a host monthly for a basic DV cert is usually a bundle leftover. Use the free cert, force HTTPS, and move on. Namecheap and other stores still sell DV, OV, and EV as products; that is fine for special procurement or a wildcard you cannot automate. For a typical WordPress site, automation beats a PDF from a certificate authority. If AutoSSL is failing, the problem is DNS validation or rate limits, not a need to buy a luxury padlock.

A wildcard covers *.example.com. Let’s Encrypt can issue wildcards via DNS-01 if your host or Cloudflare API allows it. Some teams still buy paid wildcards because their panel cannot complete DNS challenges. Extended Validation is visual theater in modern Chrome; it still appears in some enterprise procurement checklists. Multi-domain SANs help when you have several hostnames and a fussy load balancer. If you are on Kinsta or WP Engine, use their SSL flow before you import a custom cert. Custom certs make sense when a CDN or a compliance pack requires a specific CA. They do not make a WooCommerce site “more PCI” by themselves. TLS version and cipher hygiene on the server matter more than the logo in the cert details.

HTTPS on the homepage with HTTP images, scripts, or fonts is mixed content. Browsers block or warn; the site looks broken. After Let’s Encrypt, search the database for http:// your domain, fix the WordPress URL settings, and purge cache at the host and Cloudflare. Page builders store full URLs. CDNs and hotlinked assets are repeat offenders. This is the most common “SSL does not work” ticket, and it is not a certificate problem. SiteGround, WP Engine, and most panels have an HTTPS force toggle; use it after the cert is valid, not before, or you loop. Check the checkout and wp-admin too. A padlock on a blog post and a mixed cart is how you lose the sale.

Flexible mode encrypts the visitor to Cloudflare and can talk HTTP to origin. That is a compatibility hack that causes redirect loops and a false sense of security. Use Full or Full (strict) with a valid origin cert from Let’s Encrypt. Authenticated origin pulls are even better when you can. Do not proxy the mail hostname. If WordPress is confused about HTTPS behind a proxy, set the headers or constants the host documents (WP Engine and Kinsta publish this). Orange-cloud the www versus apex on purpose so you do not split cookies. Cloudflare is not a certificate authority replacement so much as a TLS terminator. Origin still needs a real cert for strict mode. Set it once; do not toggle modes to “see what happens” on a live shop.

Issue Let’s Encrypt, force HTTPS, fix mixed content, and use Cloudflare Full (strict) if you proxy. Buy paid certs for wildcards or paperwork, not for a greener padlock. Auto-renew is a setting you verify before expiry, not a vibe.