How to Get a Free SSL Certificate in 2026

A host once tried to sell me a “premium SSL” add-on for $69/year on a site that already had a free SSL certificate waiting one checkbox away. I laughed, then I got annoyed, then I wrote this. Full disclosure: early in my career I paid for one of those upsells because the panel made the free option look broken. It wasn't broken. The upsell was the product.

If your site is on a modern host or behind Cloudflare, a free SSL certificate is the default path — not a favor. I've flipped HTTPS on for landers, docs sites, and one stubborn WordPress install that only needed AutoSSL enabled.

I verified the usual suspects in August 2026: Let’s Encrypt, Cloudflare Universal SSL, and auto-HTTPS on the big free static hosts. For the domain side, pair this with our free domain name guide. For putting the site online at $0, see how to host a website for free.

Quick answer: how do I get a free SSL certificate in 2026?

Use your host’s Let’s Encrypt / AutoSSL button, or put the domain on Cloudflare and use Universal SSL, or connect a custom domain to GitHub Pages, Netlify, or Vercel and let the platform issue HTTPS automatically — then force HTTPS redirects.

When free tools stop matching the brand you're building, look at a curated name like AiFolio.app on DN Detector — escrow-backed, not a builder subdomain.

Start with whatever stack already serves the site. Don't buy a cert to feel professional when the free path is one toggle.

Method 1: Let’s Encrypt through your host (AutoSSL)

Let’s Encrypt is the free certificate authority most panels wrap as AutoSSL, “Free SSL,” or “HTTPS enable.” The cert lasts about 90 days and renews automatically when the host’s cron is healthy. I've fixed more sites by turning AutoSSL on than by buying anything.

How to enable a free SSL certificate on a typical host

1. Log into your hosting panel and find SSL/TLS, Security, or AutoSSL — names vary, the job does not.
2. Confirm the domain’s A/AAAA or CNAME records point at this host before you request issuance. Wrong DNS = failed challenge.
3. Enable AutoSSL / Let’s Encrypt for the apex and the www hostname you actually use.
4. Wait for issuance. Most panels show Active when the cert is live. Refresh stubborn browsers after.
5. Force HTTPS: enable “Force HTTPS Redirect,” “HTTPS Enforce,” or the equivalent so http requests 301 to https.
6. Load the site, click the padlock, and spot-check a few internal links for mixed content — http images and scripts still break the lock icon.
7. Note the renewal automation. If your host requires a keep-alive hit for renewal, don't ignore that email the first time it appears.

Method 2: Cloudflare Universal SSL

If the domain is on Cloudflare and the proxy is enabled, Universal SSL gives you an edge certificate without running certbot yourself. I've used this on domains that pointed at awkward origins where the host SSL UI was a maze.

How to use Cloudflare for free HTTPS

1. Add the domain to Cloudflare and complete nameserver cutover if you haven't already.
2. Proxy the web records you care about — orange cloud on the A/CNAME that serves the site.
3. Open SSL/TLS settings and pick a mode that matches your origin. Prefer Full (strict) when the origin has a valid cert.
4. Confirm Universal SSL shows active for the domain. First-time issuance can take a bit after nameservers go live.
5. Enable Always Use HTTPS and, if you want, Automatic HTTPS Rewrites for sloppy http links in HTML.
6. Test apex and www. Fix redirect loops if www↔apex rules fight Cloudflare’s HTTPS redirect — loops are common and fixable.

Cloudflare’s own SSL docs are the source of truth when the dashboard labels move around — I re-read the Universal SSL notes whenever a client swears “HTTPS is broken” and it turns out the proxy was grey-clouded.

Method 3: Auto HTTPS on GitHub Pages, Netlify, and Vercel

The free static hosts treat HTTPS as the default now. Connect a custom domain, prove ownership with the DNS records they request, and the platform issues a free SSL certificate for you.

1. Add the custom domain in the host’s domain settings.
2. Publish the DNS records they show — usually a CNAME for www and A/ALIAS for apex, or their documented variant.
3. Wait for DNS to verify. Don't toggle random settings while it's pending.
4. Enable the platform’s HTTPS / certificate provision option if it isn't automatic.
5. Turn on HTTPS-only redirects in the same panel.
6. Confirm both https://yourdomain.com and https://www.yourdomain.com behave the way you want — one canonical, one redirect.

Official starting points I actually open: GitHub Pages docs, Netlify HTTPS docs, and Vercel’s domain docs from their site. Pick one host. Finish DNS. Let them mint the cert.

What’s dead or not worth paying for

Paid “DV SSL” upsells for a brochure site are usually wasted money when Let’s Encrypt is available. Fancy EV certificates with the old green company name in the URL bar? That UI is gone. Don't buy nostalgia.

Also skip random desktop “SSL checker” tools that want a software install. Use the browser padlock and a reputable online checker if you need a second opinion.

Does a free SSL certificate hurt SEO?

No — HTTPS is expected. A working free SSL certificate helps you meet the modern baseline; it does not magically rank you above better content.

Google has treated HTTPS as a ranking signal for years, but the practical win is trust and avoiding browser warnings. If your competitors have HTTPS and you show “Not secure,” you look careless before anyone reads the copy. I've watched founders obsess over cert brands while ignoring title tags. Fix the lock icon. Then fix the content.

What if HTTPS works on www but not on the apex?

That usually means DNS or certificate coverage is incomplete — one hostname verified, the other missing from the cert or still pointing elsewhere.

Check DNS for both hosts. Check whether the cert SAN list includes both names. On Cloudflare, confirm both records are proxied if you expect Universal SSL on both. On Pages-style hosts, add both domains in the UI and set a primary. Half-configured www is the most common “my SSL is haunted” ticket I still see.

A quick diagnostic I run when someone swears their free SSL certificate “randomly died”: check the clock on the server, check whether AutoSSL’s last run logged an error, and check whether a CDN in front is serving an old edge cert. Clocks drift. Panels fail quietly. CDNs cache drama. I've spent evenings chasing “SSL is broken” when the real issue was a stale www CNAME still pointing at a decommissioned host.

Another confession: I used to disable HTTPS redirects during migrations “just for an hour.” That hour became a weekend, search consoles collected http URLs, and cleanup was uglier than doing the migration with HTTPS on from minute one. Keep redirects on. Fix loops with deliberate host rules, not by opening the barn door.

If you manage multiple brandables, standardize the SSL story the same way you standardize DNS notes. Cloudflare-proxied names get Universal SSL. Pages projects get platform certs. Orphan cPanel sites get AutoSSL. Write it down. The next time a lander shows “Not secure,” you won’t be guessing which lever to pull.

For local development, self-signed certs are fine. For anything public, stick to the free SSL certificate paths above. Don't paste a self-signed public cert “temporarily” on a sales lander. Buyers notice. Browsers notice louder.

After HTTPS is boring — the goal — wire the rest of the free stack. Mail aliases belong in the free business email guide. Privacy copy belongs in a real policy page, not a footer promise. And when the brand string is the real blocker, browse premium domains instead of duct-taping hyphens onto a weak name.

If you're building an AI product brand and want a clean .app to hang that free SSL certificate on, look at Aifolio.app as a concrete listing example — domain first, cert second, forever. Escrow and transfer questions live in the FAQ; hygiene workflows sit on domain tools.

My close: stop paying for the padlock. Turn on the free SSL certificate your stack already offers, force HTTPS, fix mixed content, and spend the money you didn't waste on something users can see — like a domain worth typing twice.