The padlock is not a decoration. It means the browser opened an encrypted connection to the server and the certificate matches the domain. Free certificates provide the same encryption as paid ones for a single domain; what you pay for elsewhere is validation depth, warranty, and support, not a stronger lock.
What a certificate actually proves
A domain-validated certificate confirms that whoever requested it controls the domain. It does not verify a company's legal name, reputation, or honesty. That is why phishing sites can have padlocks. For a blog or a small business, domain validation is enough: visitors get encryption, and browsers stop showing a warning.
Encryption protects passwords, forms, and cookies in transit. Without it, anyone on the same public Wi-Fi can read what a visitor submits. With it, they see encrypted traffic. That matters even for a site with no login and no payments.
How free certificates are issued
You request a certificate for a domain in the control panel. The provider validates control through a DNS record or a temporary file, then installs the certificate on the server. The whole process can take minutes, but it only works after DNS points at the server.
Most free certificates last about 90 days and renew automatically. Automatic renewal is convenient, not invisible. If DNS changes, the domain expires, or a validation file is removed, renewal fails and visitors see a warning. Check the certificate date once a month, and immediately after any DNS or domain change.
Make sure both the root domain and www are covered. If the certificate lists only one name, request coverage for the other or set a permanent redirect from the missing version to the covered one.
Why the browser says Not secure
A padlock can disappear for four common reasons: the certificate expired, the certificate is for a different name, the page loads insecure resources, or the site is being served over plain HTTP. The first two are server-side and show a full-page warning. The last two often show a milder warning or a crossed-out padlock.
Mixed content is the most common cause after a migration. The page itself loads over HTTPS, but an image, script, stylesheet, font, or iframe still uses an http:// address. Browsers block the active ones and warn about the rest.
Fixing mixed content
- Open the browser developer tools, go to the Console or Security panel, and note every http:// URL.
- Update the WordPress site URL to https, then search the database for old http:// references and replace them with https:// after taking a backup.
- Check theme options, page-builder settings, and widget content, which often store absolute URLs separately.
- Replace hardcoded embeds with secure versions, and remove widgets that only work over HTTP.
- Reload with a hard refresh and confirm the console is clean on at least three pages, including a post with images and a form.
Do not enable forced HTTPS until the certificate is active and the site loads over https without warnings. Forcing it too early is the fastest way to lock yourself out of the admin area.
Redirect loops and how to escape them
Too many redirects usually means two layers disagree about which protocol to use. Common causes include forcing HTTPS before the certificate was issued, a proxy or CDN set to a mode that talks to the origin over HTTP, conflicting redirect rules in .htaccess, and a WordPress site URL that still says http.
Fix it in this order: confirm the certificate is active, test https directly, correct the site URL, remove duplicate redirect rules, and only then enable forced HTTPS. If you use a CDN, set its SSL mode to full or strict so it connects to your server over HTTPS. Keep a backup of .htaccess before editing it.
Renewal, SEO, and AdSense
HTTPS is a lightweight ranking signal, but the bigger effect is practical: visitors stay, forms work, and browsers do not interrupt them with warnings. For AdSense, secure pages matter because ad scripts and consent tools load over HTTPS; mixed content can stop them from rendering and leave blank ad slots. A secure site is a baseline requirement, not a guarantee of approval or rankings.
Set a reminder to check renewal a week before the certificate expires, especially after changing nameservers or moving DNS. If renewal fails, the fix is usually DNS validation, not a new certificate. The FAQ explains where to request and check SSL, and the SSL guide walks through the first setup. When the padlock is stable, start your free site and enable HTTPS before you share the link.