Free SSL, Forced HTTPS and Mixed Content: Securing Your Site on WebGee

A secure site takes three separate steps: issue a certificate, send every visitor to HTTPS, and make sure nothing on the page still loads over plain HTTP. Each step fixes a different problem, and doing them out of order is what causes browser warnings and redirect loops.

This guide walks you through all three on WebGee shared and reseller hosting, using the tools already in your cPanel.

Step 1: issue a free certificate with AutoSSL

WebGee issues and renews free SSL certificates through AutoSSL for the lifetime of the account. The certificates are issued by Sectigo with 256-bit encryption, are valid for 90 days and renew automatically before they expire.

There is one catch. New domains are excluded from AutoSSL by default, so running AutoSSL on its own does nothing. Include the domains first:

1. In cPanel, open SSL/TLS Status in the Security section.
2. Tick the checkbox in the table header to select every domain at once.
3. Select Include Domains during AutoSSL. You see a confirmation naming each domain whose exclusion was removed.
4. Select Run AutoSSL.
5. Wait for the check to finish, then reload the page.

Each domain now shows a green padlock and AutoSSL Domain Validated. Issuance normally takes a couple of minutes, and the inclusion is a one-off: renewals need nothing further from you. The full walkthrough, with screenshots, is in Install a free SSL certificate.

Select everything, not just your main domain

The list includes the service subdomains cPanel creates, such as mail., webmail., cpanel., autodiscover. and autoconfig.. Include them all. Mail clients connect to mail., and Outlook and Apple Mail use autodiscover. and autoconfig. to configure themselves. Without certificates, those connections show security warnings even when the website itself is fine.

Confirm the certificate works

Visit https://example.com and check there is no browser warning, or test from a terminal:

The cPanel dashboard sidebar is also a quick check: it reads Active once the certificate is in place, rather than Inactive.

When AutoSSL cannot issue

If a domain stays without a certificate after you have included it, work through these causes:

• The domain does not resolve to your account. AutoSSL proves control by fetching a file over HTTP, so a domain pointing elsewhere, or still propagating, fails validation. Check which nameservers the domain uses.
• The domain is subject to export restrictions. Sectigo cannot issue to domains in certain jurisdictions under US export law. Let's Encrypt has no such restriction; select it as the provider in SSL/TLS Status.
• You need a wildcard. AutoSSL issues per-hostname certificates only. For *.example.com, use the Let's Encrypt™ SSL tool in cPanel. Wildcards are validated with a DNS TXT record, which is automatic when your DNS is hosted in cPanel and a manual step when it is hosted at Cloudflare or a registrar. See Install a wildcard certificate with Let's Encrypt.
• It is a service subdomain on an alias domain. cPanel does not create mail. or cpanel. for alias (parked) domains, so AutoSSL has nothing to secure. Use the primary domain's mail. hostname in mail clients instead; the mailbox address does not have to match the server hostname. See Why AutoSSL skips some service subdomains.

Step 2: force HTTPS

Installing a certificate does not send visitors to the secure version of your site. That is a separate setting.

Use the cPanel toggle

This is the right choice for almost every site. It works at the web server level, before any application code runs, and leaves nothing to undo if you move hosts.

1. In cPanel, open Domains.
2. Find your domain in the list.
3. Turn on Force HTTPS Redirect.

The change takes effect immediately. To change several domains at once, tick them in the left-hand column and select Enable Force HTTPS Redirect above the table.

Update WordPress to match

WordPress stores its own address. If it still says http://, it keeps generating HTTP links and bounces visitors back and forth.

1. In WordPress, go to Settings → General.
2. Set both WordPress Address (URL) and Site Address (URL) to https://example.com.
3. Select Save Changes.

Use .htaccess only for conditional rules

If you need behaviour the toggle cannot express, such as forcing HTTPS on one subdirectory but not another, add this at the top of the .htaccess file in your document root, above any existing rewrite rules. Keep each directive on its own line; Apache rejects them run together.

Use R=301, not bare R: a permanent redirect lets search engines treat the HTTPS address as canonical. Use %{HTTP_HOST} rather than a hard-coded domain, so the rule works for every domain and subdomain on the account.

Check the redirect

You want HTTP/1.1 301 Moved Permanently and a Location: header pointing at the https:// address. A 302 means the redirect is temporary. More detail is in Force HTTPS on your site.

Avoid redirect loops

A redirect loop almost always means HTTPS is forced in two places at once, commonly the cPanel toggle plus an .htaccess rule plus a plugin. Pick one and remove the others.

Behind Cloudflare, the Flexible SSL mode causes the same loop: Cloudflare requests your site over HTTP, your server redirects to HTTPS, and round it goes. Set Cloudflare's SSL mode to Full (strict), which works with your AutoSSL certificate. See Put your site behind Cloudflare.

Step 3: fix mixed content warnings

If the redirect works but the browser still shows Not secure, a broken padlock, or a page with missing styling, the page is loading images, stylesheets or scripts over plain HTTP. That is mixed content. Browsers block scripts and stylesheets outright and warn about images.

Find the offending resources

Open the browser console: in Chrome, Edge or Firefox, right-click the page and choose Inspect, then Console. In Safari, enable Develop in Advanced preferences first. Reload the page with the console open. Each warning names a URL beginning http://, and that is your list to fix.

Fix them

• WordPress: confirm both addresses in Settings → General start with https://, then install the Really Simple SSL plugin, which rewrites http:// references as pages are served. For a permanent fix, replace the URLs in the database with Better Search Replace, which handles serialised data correctly where a plain SQL find-and-replace corrupts it.
• Hand-written sites: edit each reference to use a relative path such as /logo.png or an absolute https:// URL. Relative paths work regardless of protocol or domain.
• Third-party resources: switch to the HTTPS URL if the external site offers one. If it does not, host the file yourself; there is no other way to load it securely.

The full guide is Fix mixed content warnings.

Quick recap

Include every domain in AutoSSL and run it. Confirm https:// loads cleanly. Turn on Force HTTPS Redirect in one place only, and update WordPress to match. Then use the browser console to clear any remaining http:// resources until the padlock returns on every page.