# Install SSL on Hostinger: get the padlock and fix "Not secure"

URL: https://www.savemores.store/guides/install-ssl-on-hostinger
Author: Mr. Ahmed · Published 2026-10-28 · Updated 2026-10-28 · Hosting basics

## Short answer

- Every Hostinger web, cloud and WordPress plan includes a free SSL certificate; you switch it on per website in hPanel.
- The certificate can only be issued once your domain points at Hostinger, so a fresh DNS change can delay it by a few hours.
- After it's active, force HTTPS so every http:// visit is redirected to the secure version.
- A "Not secure" warning on a site that has a certificate is almost always mixed content: an image, script or font still loading over http.

## What SSL does, in one paragraph

An SSL certificate (strictly, TLS) lets the browser and your server talk over an encrypted connection. Visitors see a padlock and an https:// address instead of a "Not secure" label. Browsers warn on any page with a form that isn't on https, search engines prefer secure pages, and payment providers won't work without it. On Hostinger it's included, so there's no reason to run a site without it.

## Before you start: the domain must point at Hostinger

The free certificate is issued by an automated authority that checks your domain really points at the server asking for it. If the domain still points at your old host, or you changed nameservers an hour ago, the check fails and the certificate stays pending.

If the domain is registered with Hostinger and uses its nameservers, you're ready. If it's registered elsewhere, point it at Hostinger first. [Pointing a domain at Hostinger](https://www.savemores.store/vps/point-domain-dns) explains A records and nameservers, and the same records apply to shared hosting.

> From the bench: Nine times out of ten, "my SSL is stuck on pending" is DNS that hasn't finished moving. Check where the domain points before you open a support chat; it saves you the wait.

## Install the free SSL certificate in hPanel

hPanel's layout changes now and then, but the path has stayed close to this. My [hPanel tour](https://www.savemores.store/guides/hpanel-tour) shows where each section lives.

1. Log in to hPanel and open **Websites**, then choose **Manage** on the site you want to secure.
2. Find **SSL** in the site's menu (it sits under Security on most accounts).
3. If the certificate shows as inactive, select **Install** or **Setup** and pick the free certificate.
4. Wait for the status to change to **Active**. This usually takes minutes, and can take a few hours if DNS changed recently.
5. Open your site with `https://` in front of the address and check for the padlock.

## Force HTTPS so nobody lands on the insecure version

Having a certificate doesn't stop someone opening `http://yourdomain.com`. You want every request redirected to https.

In hPanel, turn on the **Force HTTPS** option next to the SSL status. If you'd rather control it yourself on a PHP or WordPress site, a redirect in `.htaccess` does the same job:

.htaccess in the site's public_html folder

```apache
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]
```

> From the bench: Use one redirect method, not both. Force HTTPS plus a hand-written rule plus a WordPress plugin is how sites end up in a redirect loop.

## Update WordPress to use https

WordPress stores its own address. If it still says http, some links and images will keep loading insecurely.

1. In WordPress, open **Settings → General**.
2. Change both **WordPress Address** and **Site Address** to start with `https://`, then save. You'll be logged out; log back in.
3. Replace old http links stored in posts and pages. A search-and-replace plugin that understands serialized data is the safe way to do this; back up the database first.
4. Clear any caching plugin and Hostinger's cache so visitors get the updated pages.

## Still says "Not secure"? Find the cause

Open the page, then your browser's developer tools (F12) and the Console tab. The warnings there name the exact file at fault.

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| SSL stuck on pending | Domain doesn't point at Hostinger yet | Check DNS, wait for it to update, then retry the install |
| Padlock missing, page loads on https | Mixed content: images, scripts or fonts loading over http | Replace http:// URLs in content, theme settings and widgets |
| Works on example.com, fails on www | Certificate or DNS only covers one version | Make sure both versions point at Hostinger and are covered |
| "Too many redirects" | Two redirect rules fighting, often plus a CDN | Keep one redirect method and switch off the others |
| Certificate warning after a move | Old host's certificate cached or DNS still split | Clear browser cache and confirm DNS has finished updating |

## SSL is the start of security, not the end

A padlock means the connection is encrypted. It says nothing about whether the site itself is safe from weak passwords, old plugins or missing backups. The [website security basics](https://www.savemores.store/guides/website-security-basics) guide covers those. If you're moving a site to Hostinger, the [migration guide](https://www.savemores.store/guides/migrate-wordpress-to-hostinger) shows when to install SSL during the move, and if the site feels slow after switching to https, [this checklist](https://www.savemores.store/guides/speed-up-slow-hostinger-site) helps.

SaveMores is an independent Hostinger referral site. If you buy through a link here we may earn a commission, at no extra cost to you. That's why a coupon button appears on this page, and it's why I also say where Hostinger is the wrong choice. The [disclosure page](https://www.savemores.store/disclosure) and [how we test](https://www.savemores.store/how-we-test) explain the rest.

## FAQ

### Is SSL free on Hostinger?

Yes. Hostinger's web, cloud and WordPress hosting plans include a free SSL certificate for your sites, renewed automatically. You don't need to buy a paid certificate for a normal website or store.

### How long does Hostinger SSL take to activate?

Usually a few minutes once the domain points at Hostinger. If you changed DNS or nameservers recently, it can take a few hours, because the certificate can't be issued until the domain resolves to Hostinger.

### Why does my site say not secure even with SSL installed?

Most often it's mixed content: the page loads over https but an image, script or font still loads over http. Your browser's developer console lists the files; update their URLs to https.

### Do I need a paid SSL certificate?

Not for most sites. Free and paid certificates encrypt the connection the same way. Paid certificates mainly add organization validation or warranties that some businesses want for compliance.

### Does SSL renew automatically on Hostinger?

Yes, the free certificate renews on its own while the domain keeps pointing at Hostinger. If the domain moves away, renewal fails and the certificate eventually expires.