# SSL certificates
Source: https://docs.webgee.com/en/wordpress-cloud/ssl-certificates





WordPress Cloud issues a free **Let's Encrypt** certificate when a website is
provisioned and renews it automatically. Applies to all WordPress Cloud
packages.

Open a website and select **Security**.

<img alt="The SSL certificates page, showing an active Let's Encrypt certificate and the Force HTTPS toggle" src="__img0" />

Each row shows the certificate's status, the domain it covers, the issuer, a
**Force HTTPS** toggle and the expiry date.

## Force HTTPS [#force-https]

The toggle is **off** by default. With it off, the site answers on both `http://`
and `https://`, which splits your traffic across two URLs and leaves visitors on
whichever they arrived at.

Turn it on so every request is redirected to `https://`.

<Callout type="warn">
  After enabling Force HTTPS, check that WordPress agrees. If the **Site URL**
  under **Apps** → **Toolkit** → **General** still begins `http://`, the server
  redirect and the WordPress redirect can fight each other and produce a
  redirect loop. Set both to `https://`.
</Callout>

## Mixed content [#mixed-content]

A padlock only appears if every asset on the page also loads over `https://`. A
site migrated from `http://` usually has absolute `http://` image URLs in the
database.

Fix them at the source rather than with a plugin: run a search and replace
across the database from `http://example.com` to `https://example.com`.

## Install a certificate you bought [#install-a-certificate-you-bought]

Select **Install custom SSL** and supply the certificate, its private key and
any intermediate chain.

Use this only when you need something Let's Encrypt cannot give you — an
extended validation certificate, or one your organisation mandates. Custom
certificates do not renew automatically; you are responsible for replacing them
before the expiry date shown in the table.

## Verify [#verify]

* The domain loads over `https://` with no browser warning.
* With Force HTTPS on, entering the `http://` address lands you on `https://`.
* The expiry date in the table is roughly 90 days out for Let's Encrypt.

## Related [#related]

* [Domains, DNS and mail routing](/en/wordpress-cloud/domains-and-dns)
* [Redirects](/en/wordpress-cloud/redirects)