Secure your domain with SSL

WordPress.com automatically provides free SSL certificates for all domains and subdomains hosted on WordPress.com. In this guide, you will learn how to check if your site is secure and fix common SSL issues.

To check whether your WordPress site has SSL, visit your website:

1. Go to your WordPress website in a web browser.
2. Look at the address bar for a lock icon next to your URL.
3. If you see a lock icon, your site is secure and has SSL.

If there’s no lock icon or you see “Not secure,” check your SSL status in your Hosting Dashboard for specific errors that need to be resolved.

If you have a domain registered or connected to your WordPress.com site, you can check the SSL status by following these steps:

1. Visit the Domains section of your Hosting Dashboard.
2. Click the domain name you want to manage to open its overview page:

3. Under Settings, click “Domain security“:

4. You will find the status of your site’s SSL certificate:
   • SSL certificate active: The certificate is working. If your browser still hides the padlock, fix a missing padlock on a secure site.
   • SSL certificate pending: The certificate has not been issued yet. Learn how to fix a pending SSL certificate.

If your domain name’s security status shows “SSL certificate pending”, WordPress.com is still working to set up your SSL certificate. The certificate usually takes a few minutes to provision, but it can take up to 24 hours. During this time, visitors may see a security warning in their browser. The warning goes away on its own once the certificate is issued.

Your site stays reachable at its .wordpress.com address while the SSL certificate provisions. Set your domain name as your primary site address after the certificate is active, so visitors never see the security warning.

If you already set your domain name as your primary site address, your .wordpress.com address redirects to your domain name. To use the .wordpress.com address until the certificate is issued, switch your primary site address back to your WordPress.com address. Switch your primary site address to your domain name again once the certificate is active.

If it has been more than 24 hours and your site still shows “Not secure,” manually provision the SSL certificate.

Once you resolve the issues blocking your site’s SSL from provisioning, follow these steps to manually provision your site’s SSL certificate on WordPress.com:

1. Visit the Domains section of your Hosting Dashboard.
2. Click the domain name you want to manage to open its overview page.
3. Under Settings, click “Domain security“.
   • If this option is missing, ensure your domain name is correctly set up.
4. Click the “Provision certificate” button.

This will request the SSL certificate for your domain. If you have not yet resolved the underlying issue that prevented the SSL from being applied to your domain, the SSL provision will fail.

Some DNS settings stop WordPress.com from issuing your SSL certificate. When this happens, your Domain security section names the specific error that needs to be fixed.

You may also see browser errors such as NET::ERR_CERT_COMMON_NAME_INVALID, or Your connection to this site is not secure.

These are the errors you may see in the Domain security section:

CAA DNS records error: This domain has CAA DNS records that do not allow Let's Encrypt to issue a certificate. Please update or remove the CAA DNS records.

Mixed name servers error: This domain has a mixture of both WordPress.com and external name servers. Please update the NS records.

DNSSEC validation error: This domain has DNSSEC validation errors. You may need to remove or update the DS Record data at your registrar.

Follow the instructions below to resolve these errors, then manually provision your SSL certificate.

If your domain is connected from another registrar, ensure you have completed the domain connection to receive the WordPress.com SSL certificate. For domains connected with our name servers, also ensure that DNSSEC is disabled.

For domains registered with WordPress.com or transferred to WordPress.com, check your DNS is correctly configured with the following steps:

1. Visit the Domains section of your Hosting Dashboard.
2. Click the domain name you want to manage to open its overview page.
3. Under Settings, click “Name servers” and ensure the “Use WordPress.com name servers” option is on.
4. Return to the domain overview page and, under Settings, click “DNS records“.
5. Ensure that your domain’s A and CNAME records are set to the default values for WordPress.com by:
   1. Clicking the ellipses (three dots) at the top right of your screen.
   2. Clicking “Restore default A records” and/or “Restore default CNAME record“:

Once you have completed these steps, your WordPress.com site will appear on your domain within a few hours, and SSL will be applied shortly after. You can also manually provision the SSL certificate.

A missing padlock on a site with an active SSL certificate means the page is loading some content over an insecure http connection. This is called mixed content. The page itself is secure, but a browser will not show the padlock while any image, script, or stylesheet on the page loads over http.

Mixed content affects individual pages, so the padlock may appear on some pages of your site and not on others. To fix it on a page, follow these steps:

1. Open the page that shows the security warning, then open your browser’s console.
2. Reload the page.
3. Look for a warning or error that mentions mixed or insecure content. It names the http:// address of each insecure file.

4. Open the page or post in the editor.
5. Find the block that contains that address. This is often an Embed block or a Custom HTML block.
6. Replace http:// with https:// in the address, then click Update to save your changes.
7. Clear your browser’s cache, then reload the page and check for the padlock.

If the https:// version of an address does not load, the file is hosted somewhere that does not support secure connections. Upload the file to your WordPress.com site instead. Media you upload to WordPress.com is always served over https.

Your domain’s SSL certificate renews automatically when you renew your domain—you don’t need to renew SSL separately. Your SSL certificate will stay active as long as the domain is connected to a WordPress.com site.

WordPress.com does not support disabling SSL. All insecure HTTP requests redirect to the secure HTTPS version.

SSL certificates encrypt the connection between your website and your visitors’ browsers. This protects sensitive information and makes your site appear trustworthy. Modern browsers show a lock icon for secure sites and may warn visitors about insecure sites.

All WordPress.com sites get free SSL certificates automatically—there’s nothing you need to buy or set up yourself.

SSL certificates on WordPress.com come from the Let’s Encrypt Certificate Authority. All certificates on WordPress.com use the same Common Name, tls.automattic.com, and store the unique domain names (grouped in batches of about 50) in the SubjectAltName attribute. All modern browsers honor this attribute, so you and your visitors will not encounter any security warnings on your site.

TLS is the upgraded version of SSL, although the terms SSL and TLS are often used interchangeably. WordPress.com supports TLS versions TLSv1.2 and TLSv1.3.

WordPress.com also sends a Strict-Transport-Security (HSTS) header with all HTTPS responses, ensuring your site is accessed via https instead of the less-secure http.