HTTPS Done Right on cPanel: AutoSSL, Redirects, HSTS and Mixed Content

Getting HTTPS right on a cPanel server takes four steps: let AutoSSL issue and renew a valid certificate for every domain and its www version, force HTTPS with a permanent redirect, add HSTS only once everything works over HTTPS, and remove mixed content so browsers do not block parts of your pages. AutoSSL handles most of the certificate work automatically, but it can only secure domains that pass validation, so the most common problems are DNS and configuration issues rather than the certificate itself. Here is how to check each step on your own sites.

Step 1: Understand what AutoSSL does (and does not do)

AutoSSL is the cPanel & WHM feature that requests, installs and renews free domain-validated (DV) certificates for the domains on your server. According to cPanel's documentation:

• Let's Encrypt is the default provider on new installations and is included with the cPanel license. The server administrator can choose the provider, or disable AutoSSL, in WHM under Manage AutoSSL.
• Domains must pass Domain Control Validation (DCV). AutoSSL only includes domains and subdomains that prove they point to your server. If the www. version of a domain fails DCV, AutoSSL does not secure it.
• It runs on a schedule. AutoSSL runs nightly as part of the cPanel update process, and also after a new account is created. You can trigger it manually from SSL/TLS Status in cPanel ("Run AutoSSL") or from WHM.
• It renews before expiry. cPanel's SSL guide says AutoSSL attempts to renew Let's Encrypt certificates when they are within 29 days of expiring.
• It does not replace certificates it did not issue, unless the administrator enables "Allow AutoSSL to replace invalid or expiring non-AutoSSL certificates". cPanel warns that this option can replace a paid OV or EV certificate with a DV one, so turn it on only if you understand the effect.
• Suspended accounts are skipped.

Certificate lifetimes are getting shorter

Let's Encrypt has announced a move from 90-day to 45-day certificates. Its published schedule moves the default profile to 64-day certificates on February 10, 2027 and to 45-day certificates on February 16, 2028. Automated renewal through AutoSSL handles this for you, which is one more reason not to rely on manually installed certificates that someone has to remember to replace.

Step 2: Fix the usual AutoSSL problems

Open cPanel > SSL/TLS Status. Each domain shows whether it is covered, and domains with errors show a "Has AutoSSL Problems" status with the reason. The administrator can also read the logs in /var/cpanel/logs/autossl/.

The most common causes:

1. The domain points somewhere else. If DNS for the domain or its www record points to another server, a CDN or an old host, DCV fails. Fix the A/AAAA records or, behind a proxy such as Cloudflare, make sure the validation request can still reach your server.
2. Leftover AAAA (IPv6) records. An old IPv6 record pointing to a different server can make validation fail even when the IPv4 record is correct.
3. A CAA record blocks the certificate authority. cPanel notes that existing CAA records that do not allow Let's Encrypt must be updated.
4. Rewrite rules interfere with validation. Custom .htaccess rules that redirect or block everything can stop the validation file from being served. Validation uses the /.well-known/ path, so do not block it.
5. Rate limits. Let's Encrypt limits how many certificates can be issued in a period, and cPanel deprioritizes renewals behind new certificates. If you just moved many domains, give it a day before assuming something is broken.

After fixing the cause, click Run AutoSSL and recheck the status.

Step 3: Force HTTPS with a permanent redirect

Once each domain shows a valid certificate, make sure every visitor ends up on HTTPS.

Use the Force HTTPS Redirect toggle

In cPanel > Domains, each domain has a Force HTTPS Redirect toggle. According to cPanel's documentation, you can only turn it on when the domain has a valid SSL certificate, and the toggle is not available for aliases. This is the simplest option and avoids hand-written rules.

Or redirect in .htaccess

If you need more control, a typical Apache rule is:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Use only one method. Two overlapping redirects (for example, the cPanel toggle plus a plugin plus an .htaccess rule) are a common cause of redirect loops, especially behind a CDN that connects to your server over plain HTTP.

Update the application too

Redirects fix the address bar, but the application should also know its own address. In WordPress, set both WordPress Address and Site Address to the https:// version. Update canonical URLs, your sitemap and the property in Google Search Console as well.

Step 4: Add HSTS, carefully

HTTP Strict Transport Security (HSTS) tells browsers to only ever use HTTPS for your domain, even if someone types http:// or clicks an old link. MDN explains how it works:

• The header is only honored when received over HTTPS, and it does not protect the very first visit (preloading addresses that).
• While the policy is active, users cannot click through certificate errors on your site.
• includeSubDomains applies the policy to every subdomain, so any subdomain without valid HTTPS becomes unreachable.

A safe rollout:

1. Confirm every subdomain you use (mail, webmail, portals, staging) has a valid certificate.
2. Start with a short policy, for example one day: Header always set Strict-Transport-Security "max-age=86400" in the site's .htaccess (Apache with mod_headers).
3. After a few weeks without problems, raise it to one year (max-age=31536000) and add includeSubDomains if all subdomains are ready.
4. Only consider preload (submitting to hstspreload.org) when you are sure. It requires at least one year of max-age plus includeSubDomains, and it is hard to undo.

HSTS is powerful precisely because it is hard to reverse, so treat it as the last step, not the first.

Step 5: Clean up mixed content

Mixed content happens when an HTTPS page loads resources over HTTP. Per MDN, modern browsers automatically upgrade some of these requests (such as simple images, audio and video) and block others, including scripts, stylesheets, iframes, web fonts and fetch requests. Blocked resources can break menus, forms, fonts or checkout pages.

To find and fix it:

1. Open the page in your browser, press F12 and check the Console for mixed content warnings.
2. Replace hard-coded http:// links to your own domain with https:// or relative links. In WordPress, a careful database search-and-replace (after a backup) handles links stored in posts and settings.
3. Switch third-party scripts, fonts and embeds to their HTTPS versions. If a provider does not support HTTPS, replace it.
4. As a safety net, the Content-Security-Policy: upgrade-insecure-requests header asks browsers to upgrade all requests, but MDN notes that it cannot help if the HTTPS version of a resource does not exist.

Quick HTTPS checklist

• Every domain and www version shows a valid certificate in SSL/TLS Status.
• No AutoSSL errors, and AutoSSL notifications go to someone who reads them.
• One redirect method sends all traffic to HTTPS with a 301.
• The application, canonical URLs and sitemap use https://.
• No mixed content warnings in the browser console.
• HSTS added gradually, after the steps above.

Need a hand with your certificates?

Expired certificates, redirect loops and blocked scripts are fixable, but they cost sales while they last. Core Florida IT manages cPanel servers and business websites for companies across Miami-Dade and South Florida, with remote support nationwide. Request a free IT assessment and we will review HTTPS on your domains.

Sources

• cPanel & WHM Documentation: Guide to SSL
• cPanel & WHM Documentation: Manage AutoSSL
• cPanel Documentation: Domains (Force HTTPS Redirect)
• MDN Web Docs: Strict-Transport-Security
• MDN Web Docs: Mixed content
• Let's Encrypt: Decreasing certificate lifetimes to 45 days