Secure your domain with SSL

WordPress.com automatically provides free SSL certificates for all domains and subdomains hosted on WordPress.com. In this guide, you will learn how to check if your site is secure and fix common SSL issues.

The fastest way to check if your site has SSL is to visit your website:

1. Go to your website in a web browser.
2. Look at the address bar for a lock icon next to your URL.
3. If you see a lock icon, your site is secure and has SSL.

If there’s no lock icon or you see “Not secure,” check your SSL status through your WordPress.com dashboard for specific errors that need to be resolved.

If you have a domain registered or connected to your WordPress.com site, you can check the SSL status by following these steps:

1. Visit your site’s dashboard.
2. Navigate to Upgrades → Domains (or Hosting → Domains if using WP Admin).
3. Click on your domain name.
4. Click to expand the “Domain security” section.
5. You will find the status of your site’s SSL certificate:
   • SSL certificate active: The SSL certificate is active, and your site is secure.
   • SSL certificate pending: The SSL certificate has not been provisioned yet.

If you see “SSL certificate pending” in your Domain security section, this means WordPress.com is still working to set up your SSL certificate.

Additionally, when you visit your site, you may see errors like NET::ERR_CERT_COMMON_NAME_INVALID, or Your connection to this site is not secure.

You may also see specific error messages in your Domain security section that need to be fixed:

CAA DNS records error: This domain has CAA DNS records that do not allow Let's Encrypt to issue a certificate. Please update or remove the CAA DNS records.

Mixed name servers error: This domain has a mixture of both WordPress.com and external name servers. Please update the NS records.

DNSSEC validation error: This domain has DNSSEC validation errors. You may need to remove or update the DS Record data at your registrar.

Follow the instructions below to resolve these errors, and then manually provision your SSL certificate.

If your domain is connected from another registrar, ensure you have completed the domain connection to receive the WordPress.com SSL certificate. For domains connected with our name servers, also ensure that DNSSEC is disabled.

For domains registered with WordPress.com or transferred to WordPress.com, check your DNS is correctly configured with the following steps:

1. From your site’s dashboard, navigate to Upgrades → Domains (or Hosting → Domains if using WP Admin).
2. Click on your domain name.
3. Click on the Name Servers section and ensure the option to “Use WordPress.com name servers” is in the ON position.
4. Click on the DNS Records section and click the “Manage” button.
5. Ensure that your domain’s A and CNAME records are set to the default values for WordPress.com by:
   1. Clicking the ellipses (three dots) at the top right of your screen.
   2. Clicking “Restore default A records” and/or “Restore default CNAME record”:

Once you have completed these steps, your WordPress.com site will appear on your domain within a few hours, and SSL will be applied shortly after. You can also manually provision the SSL certificate.

Once you resolve the issues blocking your site’s SSL from provisioning, follow these steps to manually provision your site’s SSL certificate:

1. Visit your site’s dashboard.
2. Navigate to Upgrades → Domains (or Hosting → Domains if using WP Admin).
3. Click on your domain.
4. Scroll down to the “Domain security” section and click the heading to expand the section.
   • If this section is missing, ensure your domain name is correctly set up.
5. Click the “Provision certificate” button.

This will request the SSL certificate for your domain. If you have not yet resolved the underlying issue that prevented the SSL from being applied to your domain, the SSL provision will fail.

Your domain’s SSL certificate renews automatically when you renew your domain — you don’t need to renew SSL separately. Your SSL certificate will stay active as long as the domain is connected to a WordPress.com site.

WordPress.com considers strong encryption so crucial that SSL cannot be disabled. WordPress.com also redirects all insecure HTTP requests to the secure HTTPS version.

SSL certificates encrypt the connection between your website and your visitors’ browsers. This protects sensitive information and makes your site appear trustworthy. Modern browsers show a lock icon for secure sites and may warn visitors about insecure sites.

All WordPress.com sites get free SSL certificates automatically – there’s nothing you need to buy or set up yourself.

SSL certificates on WordPress.com come from the Let’s Encrypt Certificate Authority. All certificates on WordPress.com use the same Common Name, tls.automattic.com, and store the unique domain names (grouped in batches of about 50) in the SubjectAltName attribute. All modern browsers honor this attribute, so you and your visitors will not encounter any security warnings on your site.

TLS is the upgraded version of SSL, although the terms SSL and TLS are often used interchangeably. WordPress.com supports TLS versions TLSv1.2 and TLSv1.3.

WordPress.com also sends a Strict-Transport-Security (HSTS) header with all HTTPS responses, ensuring your site is accessed via https instead of the less-secure http.