Installing an SSL certificate and forcing HTTPS in cPanel

To secure a site in cPanel you install an SSL certificate, then force every visitor onto the HTTPS version with a redirect. On ASEOHosting servers most domains get a free, auto-renewing certificate through AutoSSL, so in practice the certificate is often already in place and your main job is to confirm it and switch on the redirect. This guide covers both parts.

Step 1: Check or issue the certificate with AutoSSL

Modern cPanel (Jupiter theme) issues free Domain Validated certificates automatically. Before buying or pasting anything, check whether coverage already exists.

1. Log in to cPanel and go to the Security section.
2. Click SSL/TLS Status.
3. Review the list of domains and subdomains. A green padlock means the host is already covered by a valid certificate.
4. If a domain shows no certificate, tick it and click Run AutoSSL. Issuance usually completes within a few minutes once DNS points at the server.

AutoSSL only validates hostnames that resolve to this account, so make sure the domain's A record points at your server IP first. If you run dedicated Class C IPs for footprint control, confirm each site resolves to its own IP before running AutoSSL.

Step 2: Install a purchased or custom certificate (optional)

If you bought an Organization Validated or Extended Validation certificate, or received one from a third party, install it manually.

1. In the Security section, click SSL/TLS, then Manage SSL sites.
2. Choose the domain from the drop-down.
3. Paste the certificate (CRT), the private key (KEY), and the CA bundle into the matching boxes. cPanel autofills the key if it was generated on this server.
4. Click Install Certificate.

See the official cPanel documentation for details on each field.

Step 3: Force HTTPS for every visitor

A certificate alone does not stop people reaching the insecure http:// version. You need a permanent (301) redirect. cPanel offers a one-click switch, and you can also do it by hand.

1. Go to the Domains section and click Domains.
2. Find the domain in the list and toggle Force HTTPS Redirect to on.

If you prefer to control it yourself, add these lines to the top of the .htaccess file in the site's document root:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

The 301 status tells search engines the move is permanent, so ranking signals consolidate on the HTTPS URLs instead of splitting across two versions.

Step 4: Verify and clean up mixed content

After the redirect is live, load the site and confirm the browser shows a padlock with no warnings. If the padlock is missing, the page is probably loading images, scripts, or stylesheets over http://. Update those references to https:// or protocol-relative URLs. In WordPress, set both the Site Address and WordPress Address to the HTTPS version under Settings, and a plugin can rewrite lingering internal links.

Certificates issued by AutoSSL renew automatically, so there is nothing to track manually. For a paid certificate, note the expiry date and reinstall before it lapses.

Related reading

For a fuller walkthrough of certificate types and renewals, see our SSL certificates page, or browse more guides in the SSL certificates FAQ. If you are securing a WordPress install, our WordPress SEO hosting notes cover HTTPS alongside caching and performance. Stuck on validation or a stubborn redirect loop? Contact us and we will check it from the server side.