Adding an SSL certificate to your website is now more than just a layer of added security. It offers a feeling of trust for your visitors or customers. It's as important as other parts of your website like content, layout, design or even search engine optimisation. Google has already confirmed that HTTPS websites get an additional boost in search ranking. The best part you don't need to spend a hefty amount yearly for buying SSL certificates. You can easily add an SSL certificate to your website for free.
One of the important parts of securing your website is to configure it with Secure Socket Layer (SSL) certificate. By doing so your website and visitors will be protected from any third-party interceptions.
Who and Why your website need an SSL certificate?
- If your website asks information like name, email, password or credit card from visitors, then you need an SSL certificate.
- Selling products or service on your website and accepting online payments? You definitely need an SSL certificate.
- Protect your website and visitors data from third-party interception.
- HTTPS website brings an extra layer of trust for your website.
- HTTPS now included in Google's search ranking signal, so you could rank higher in Google search results.
Now you have decided to add an SSL certificate to your website and make it available through HTTPS (HyperText Transfer Protocol Secure). There are lots of free SSL certificate providers like Let's encrypt, StartCom and Comodo. If you want to further boost your credibility by confirming the authenticity of your business like showing the company name in the green address bar, then you can choose to buy an Organization Validation SSL Certificate from Namecheap and Bluehost.
Out here we are not going for the paid SSL certificates, but equally secure free SSL certificates. Let's learn how to add a free SSL certificate to your website hosted on a shared hosting, cloud hosting, VPS or Dedicated servers. You can add the free SSL certificate to any type of website platform like WordPress, Joomla, Drupal etc. We will also be covering on how to make your WordPress site accessible over HTTPS while implementing an SSL certificate.
Enable HTTPS on your website via Cloudflare
One of the easiest ways to make your website HTTPS or add an SSL certificate to your website is through Cloudflare. Most of you may already be using various services offered by Cloudflare like CDN, DNS, DDoS protection and security. One of its service offered for free includes the shared Cloudflare Universal SSL certificate. Here is how to quickly enable the free SSL certificate for your website via Cloudflare.
- If you are already using the service then login to your Cloudflare account and go to 'Crypto' tab. If you are new to Cloudflare, then register there for free and point your domain DNS to CloudFlare nameservers.
- Under the SSL section choose 'Flexible SSL'
- Then toggle ON the 'Automatic HTTPS Rewrites'. This will solve the mixed content issue by changing "HTTP" to "HTTPS" for all resources or links (like CSS, JavaScript and images) in your website.
- That's it, you can now access your website via HTTPS (https://yourwebsitename.com).
If you have a WordPress website, then you may need to install the Cloudflare WordPress Plugin or Cloudflare Flexible SSL for enabling additional features and most importantly to solve the infinite redirect loops. Once the plugin is enabled and configured you also need to change 'WordPress Address (URL)' and 'Site Address (URL)' under the Settings tab in the WordPress backend to the new HTTPS website address.
Add Free SSL on a website via EasyEngine
If you are running your own servers on the cloud, VPS or Dedicated hosting then I would highly recommend EasyEngine. Using it you can build and manage a high-performance fast web server that's also feature-rich. You can read about it in our previous article titled: Build a Super Optimized WordPress Website with EasyEngine on DigitalOcean.
Once you have the EasyEngine installed and running on the server, you can run the below command to add a free SSL certificate to your WordPress website.
ee site create example.com --php7 --wpredis --letsencrypt
The above command will build a new WordPress website with NGINX, PHP7, Redis Cache and add a free SSL certificate from Let's Encrypt. The free SSL certificate will get auto-renewed every 90 days.
If you have been running a WordPress site with http:// using EasyEngine then you can easily upgrade to https:// with the following command.
ee site update example.com --letsencrypt
Add Free SSL on a website hosted in Cloud, VPS, Dedicated Servers
If your website is hosted on a Cloud server like DigitalOcean, or in its own VPS/Dedicated server and has full root access then you can easily add an SSL certificate to your website. We will be using EFF's Certbot to automatically enable HTTPS for your website by deploying Let's Encrypt certificates. The best part, Certbot package comes with a cron job that will renew your SSL certificates automatically before they expire (that's every 90 days).
The Certbot works seamlessly on popular web servers like Apache, Nginx, Haproxy, Plesk etc running on Linux distros like Ubuntu, Debian, CentOS, FreeBSD, OpenBSD, Fedora and more. Find the below instruction to install Let's Encrypt certificates in an Apache server running on Ubuntu 16.10.
Once you have logged-in the server with root access, run the following commands. This will install the Certbot ACME client on your server.
sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-apache
Run the following command to get Let's Encrypt certificate for your website and have Certbot edit your Apache configuration automatically to serve it.
sudo certbot --apache -d example.com -d www.example.com
Note that, the first time you run the above command, it will make an account, and ask for an email and agreement to the Let's Encrypt Subscriber Agreement.
Certbot packages also come with a cron job that can automatically renew your Let's Encrypt certificate before they expire. Run the following command to set up a cron job to auto-renew the SSL certificate.
sudo crontab -e
This will open a text editor with some help text in it. Paste the below line at the end of the file, then save and close it. It says to run the auto-renew command at 2:00 am every day.
00 2 * * * /usr/bin/certbot renew --quiet
If you are using any other type of web servers like Nginx and other types of Linux distros then you can find the instructions for Certbot and steps to install Let's Encrypt for your website at Certbot website.
If you have a WordPress website then you may need to install the Really Simple SSL plugin. This plugin will make sure all the resources and request from your website is served over HTTPS.
That's it you have successfully added a free SSL certificate to your website and made it more secure. If you have any doubts implementing an SSL certificate on your website, let me know in the comment section below.