Hosting basics
Install SSL on Hostinger: get the padlock and fix "Not secure"
Turn on Hostinger's free SSL in hPanel, force every visitor onto https, and fix the usual reasons a site still says "Not secure" after the certificate is active.
By Mr. Ahmed · 20+ years in tech
Published · 6 min read
The short answer
- 01Every Hostinger web, cloud and WordPress plan includes a free SSL certificate; you switch it on per website in hPanel.
- 02The certificate can only be issued once your domain points at Hostinger, so a fresh DNS change can delay it by a few hours.
- 03After it's active, force HTTPS so every http:// visit is redirected to the secure version.
- 04A "Not secure" warning on a site that has a certificate is almost always mixed content: an image, script or font still loading over http.
What SSL does, in one paragraph
An SSL certificate (strictly, TLS) lets the browser and your server talk over an encrypted connection. Visitors see a padlock and an https:// address instead of a "Not secure" label. Browsers warn on any page with a form that isn't on https, search engines prefer secure pages, and payment providers won't work without it. On Hostinger it's included, so there's no reason to run a site without it.
Before you start: the domain must point at Hostinger
The free certificate is issued by an automated authority that checks your domain really points at the server asking for it. If the domain still points at your old host, or you changed nameservers an hour ago, the check fails and the certificate stays pending.
If the domain is registered with Hostinger and uses its nameservers, you're ready. If it's registered elsewhere, point it at Hostinger first. Pointing a domain at Hostinger explains A records and nameservers, and the same records apply to shared hosting.
Install the free SSL certificate in hPanel
hPanel's layout changes now and then, but the path has stayed close to this. My hPanel tour shows where each section lives.
- 1Log in to hPanel and open Websites, then choose Manage on the site you want to secure.
- 2Find SSL in the site's menu (it sits under Security on most accounts).
- 3If the certificate shows as inactive, select Install or Setup and pick the free certificate.
- 4Wait for the status to change to Active. This usually takes minutes, and can take a few hours if DNS changed recently.
- 5Open your site with
https://in front of the address and check for the padlock.
Force HTTPS so nobody lands on the insecure version
Having a certificate doesn't stop someone opening http://yourdomain.com. You want every request redirected to https.
In hPanel, turn on the Force HTTPS option next to the SSL status. If you'd rather control it yourself on a PHP or WordPress site, a redirect in .htaccess does the same job:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]Update WordPress to use https
WordPress stores its own address. If it still says http, some links and images will keep loading insecurely.
- 1In WordPress, open Settings → General.
- 2Change both WordPress Address and Site Address to start with
https://, then save. You'll be logged out; log back in. - 3Replace old http links stored in posts and pages. A search-and-replace plugin that understands serialized data is the safe way to do this; back up the database first.
- 4Clear any caching plugin and Hostinger's cache so visitors get the updated pages.
Still says "Not secure"? Find the cause
Open the page, then your browser's developer tools (F12) and the Console tab. The warnings there name the exact file at fault.
| Symptom | Likely cause | Fix |
|---|---|---|
| SSL stuck on pending | Domain doesn't point at Hostinger yet | Check DNS, wait for it to update, then retry the install |
| Padlock missing, page loads on https | Mixed content: images, scripts or fonts loading over http | Replace http:// URLs in content, theme settings and widgets |
| Works on example.com, fails on www | Certificate or DNS only covers one version | Make sure both versions point at Hostinger and are covered |
| "Too many redirects" | Two redirect rules fighting, often plus a CDN | Keep one redirect method and switch off the others |
| Certificate warning after a move | Old host's certificate cached or DNS still split | Clear browser cache and confirm DNS has finished updating |
SSL is the start of security, not the end
A padlock means the connection is encrypted. It says nothing about whether the site itself is safe from weak passwords, old plugins or missing backups. The website security basics guide covers those. If you're moving a site to Hostinger, the migration guide shows when to install SSL during the move, and if the site feels slow after switching to https, this checklist helps.
SaveMores is an independent Hostinger referral site. If you buy through a link here we may earn a commission, at no extra cost to you. That's why a coupon button appears on this page, and it's why I also say where Hostinger is the wrong choice. The disclosure page and how we test explain the rest.
Questions people ask
Is SSL free on Hostinger?
Yes. Hostinger's web, cloud and WordPress hosting plans include a free SSL certificate for your sites, renewed automatically. You don't need to buy a paid certificate for a normal website or store.
How long does Hostinger SSL take to activate?
Usually a few minutes once the domain points at Hostinger. If you changed DNS or nameservers recently, it can take a few hours, because the certificate can't be issued until the domain resolves to Hostinger.
Why does my site say not secure even with SSL installed?
Most often it's mixed content: the page loads over https but an image, script or font still loads over http. Your browser's developer console lists the files; update their URLs to https.
Do I need a paid SSL certificate?
Not for most sites. Free and paid certificates encrypt the connection the same way. Paid certificates mainly add organization validation or warranties that some businesses want for compliance.
Does SSL renew automatically on Hostinger?
Yes, the free certificate renews on its own while the domain keeps pointing at Hostinger. If the domain moves away, renewal fails and the certificate eventually expires.
Independent site, not Hostinger. Buy through my links and Hostinger pays me a referral fee; your price is the same or lower. How that works.