How do I activate my free SSL?

Every Fist Host hosting package comes with a free wildcard SSL certificate. To activate free SSL and enable the more secure ‘HTTPS’ protocol to keep your site users secure, you’ll need to make sure you’ve pointed the domain name to our nameservers.

• Login to your Control Panel.
• Under Security, click on the SSL/TLS icon
• You will then see your domain name and an option to Activate Free SSL next to it – select this and the SSL will be applied to your domain
• If you’d like all your visitors to use SSL connections (i.e. for HTTPS to always be used), simply select the Enable option at the bottom of the page​

Once the SSL Certificate has been activated, it will take up to 30 minutes to secure your website. This is due to the changes needed to be made on our load balancers.

When you activate free SSL, your website gets a valid certificate that encrypts data between your visitors’ browsers and your server. This protects login credentials, contact form submissions, and payment details from interception. Search engines also prefer HTTPS sites, so enabling SSL can improve your rankings. The free wildcard SSL covers your main domain and all subdomains automatically. For more details on SSL/TLS certificates, see SSL.com.

If your site does not show as secure after you activate free SSL, wait the full 30 minutes for the load balancers to update, then clear your browser cache and check again. Make sure your WordPress Site URL and Home URL use https:// rather than http://, and update any hardcoded http:// links in your content. Mixed content warnings occur when secure pages load insecure resources. For more hosting guides, visit the Fist Host blog. Contact FistHost support if you need help enabling SSL on your domain or troubleshooting any certificate installation issues you encounter.

Frequently Asked Questions

Related Guides

• Can I Install a Third-Party SSL Certificate
• Web Hosting Sale 2026 – FistHost vs Hostinger, BlueHost, NameCheap Compared (WelcomeGift Coupon)

What the Free SSL Covers

The free wildcard certificate covers your main domain and all subdomains (for example shop.yourdomain.com) automatically — you do not need to activate it separately for each subdomain. It provides the same browser padlock and HTTPS encryption as a paid basic certificate, which is enough for blogs, business sites, and contact forms.

Fixing “Not Fully Secure” Warnings

After activation, if browsers show the site as “not fully secure”, some page elements are still loading over HTTP — this is called mixed content. In WordPress, go to Settings and make sure both the Site URL and Home URL start with https://. Then update old http:// links in your content, clear your cache, and reload the page to confirm the padlock appears.

One last tip: after enabling HTTPS, update your Google Search Console property to the https:// version so Google tracks the secure URLs. This keeps your search data accurate and avoids splitting ranking signals between http and https versions.