Free SSL on Every Hostlas Site: Setup, Verification, and Troubleshooting

HTTPS is no longer optional — browsers actively warn visitors away from unencrypted sites, and search engines factor HTTPS into ranking signals. The good news is that on Hostlas, encryption is included rather than an upsell. This guide covers exactly what's included, how the certificate gets issued, how to force HTTPS site-wide, and how to resolve the mixed-content warnings that trip up almost everyone at least once.

What's included with Hostlas free SSL

Eligible Hostlas hosting plans include a free SSL certificate for every domain and properly configured subdomain on the account. This certificate:

• Encrypts traffic between visitors' browsers and your Hostlas server
• Enables the padlock and "Secure" indicator in modern browsers
• Is issued and renewed automatically — there's no manual renewal step or expiry to track like there sometimes is with third-party certificates
• Covers standard use cases for blogs, business sites, stores, and applications without an additional purchase

If you have a specific compliance requirement for an extended-validation (EV) certificate or a specific certificate authority, that's a separate conversation — but for the overwhelming majority of sites, the included certificate is exactly what's needed.

How certificate issuance actually works

• Point your domain to Hostlas — either by updating nameservers to Hostlas's, or by pointing the domain's A record to the assigned server IP if you're keeping DNS elsewhere
• Wait for DNS propagation — this can take anywhere from a few minutes to a few hours depending on your previous DNS provider's TTL settings
• Certificate issuance triggers automatically once Hostlas can verify the domain resolves correctly — this is typically fast, but can take some time on freshly registered or newly pointed domains
• Enable the HTTPS redirect in the control panel once the certificate status shows active, so visitors are automatically sent to the secure version of every URL

Forcing HTTPS site-wide

Simply having a certificate installed isn't the same as forcing every visitor onto the encrypted version of your site. To close that gap:

• Enable the HTTPS redirect toggle in your Hostlas control panel — this is the simplest and most reliable method and handles the redirect at the server level
• If you manage redirects yourself via .htaccess or application config, ensure all http:// requests 301-redirect to https://, including the www and non-www variants
• Update your site's internal settings (WordPress Address / Site Address fields, or equivalent in other CMSs) to use the https:// URL so the platform itself doesn't generate insecure links
• Update your sitemap and any hardcoded canonical tags to reference https:// URLs

Fixing mixed-content warnings

A padlock that shows "not fully secure" almost always means the page itself loads over HTTPS, but it's pulling in some resources over plain HTTP — images, scripts, stylesheets, or embeds. Here's how to track it down:

• Open the browser's developer console on the affected page — mixed-content warnings are logged explicitly and usually name the exact offending URL
• Search your site's database or theme files for hardcoded http:// references pointing to your own domain or embedded third-party assets
• Update those references to https://, or better, to protocol-relative or root-relative URLs so this doesn't recur
• For WordPress specifically, a search-and-replace on the database (via a plugin or your hosting file manager) is often the fastest fix if the issue stems from an old HTTP-based migration
• Re-check the page in an incognito window after clearing cache, since cached HTML can mask a fix that already worked

Common causes of mixed content

• Old content written back when the site ran on HTTP, with image or link URLs hardcoded to http://
• Third-party embeds (widgets, ad scripts, old video embeds) that still reference HTTP endpoints
• Migrated sites where the database still contains the previous host's HTTP URLs
• Custom themes or page builders with hardcoded asset paths from an early build stage

Verifying everything is correctly configured

• [ ] Certificate status shows active in the Hostlas control panel
• [ ] HTTPS redirect is enabled and every http:// URL correctly forwards to https://
• [ ] Site's internal URL settings use https://
• [ ] No mixed-content warnings appear in the browser console on key pages (home, checkout, contact)
• [ ] Sitemap and canonical tags reference https:// URLs

When to contact support

If the certificate has been stuck in a pending state well beyond normal DNS propagation windows, or shows an error rather than pending/active, that's the right time to reach out — Hostlas support can check certificate issuance logs directly and confirm whether DNS is fully resolved on their end. Have your domain name and the approximate time you pointed DNS ready when you contact them, since that speeds up diagnosis considerably.

Getting started

If you're setting up a new site, review hosting options on web hosting or WordPress hosting — SSL is included on eligible plans by default, so there's no separate certificate purchase to plan for. Manage your domain's DNS and nameserver settings directly from Hostlas domains once you're ready to connect it.

HTTPS should be a "set it up once and forget about it" part of running a site — with automatic issuance and renewal, that's exactly what Hostlas free SSL is designed to deliver.