How to Set Up SSL and HTTPS on a New Domain (Free, Step by Step)

To put SSL and HTTPS on a new domain, you install a TLS certificate that proves the site belongs to you, then serve the site over HTTPS instead of plain HTTP. On almost every modern host this is free and mostly automatic: hosts like Cloudflare, Vercel, Netlify, Shopify, Squarespace, and most cPanel providers issue a free Let's Encrypt certificate the moment your domain's DNS points at them, usually within minutes. You rarely buy a certificate anymore. The two things you actually control are pointing the domain correctly and, if your host does not automate it, forcing HTTPS so visitors never land on the insecure version. This guide walks the whole thing end to end for a domain you just bought.

What is SSL and HTTPS, and what is the difference?

SSL is the security layer that encrypts traffic between a visitor's browser and your website, and HTTPS is what you call a page served over that secure connection. The technology is technically TLS now, the modern successor to the old SSL protocol, but the industry still says "SSL certificate" out of habit. In practice: you install an SSL/TLS certificate on your host, and once it is active, your pages load as HTTPS with a padlock in the address bar. Without it, browsers show a "Not secure" warning, forms are unencrypted, and Chrome and Safari actively discourage visitors from continuing.

Do I need an SSL certificate for a new domain?

Yes, any domain that serves a real website needs SSL, and there is no reason to skip it because it is free. Browsers mark plain HTTP pages as "Not secure", which scares off buyers and kills form submissions. Google has treated HTTPS as a ranking signal since 2014, so an unsecured site is quietly handicapped in search. And any page that collects an email, a password, or a payment must be encrypted to be trustworthy or compliant. The only domains that do not need a certificate are ones you are merely parking or forwarding, since there is no site being served.

How much does an SSL certificate cost?

For a normal website, nothing. The certificate type you need is a Domain Validation (DV) certificate, and Let's Encrypt, a nonprofit certificate authority, issues those for free and automatically. Most hosting platforms build Let's Encrypt in, so you never see the certificate at all. You would only pay for a certificate if you specifically want Organization Validation (OV) or Extended Validation (EV), which display verified company details and suit large enterprises or banks, and those run anywhere from tens to hundreds of dollars a year. For the vast majority of businesses, the free DV certificate is exactly right.

How do I set up SSL and HTTPS on a domain?

The exact clicks depend on your host, but the sequence is the same everywhere, and on managed platforms most of it happens for you.

1. Point the domain at your host first. The certificate authority has to reach your domain to prove you control it, so your DNS must already point at the host. If that part is new to you, our guide on pointing a domain to a website covers it.
2. Let the host issue the certificate. On Cloudflare, Vercel, Netlify, Shopify, Squarespace, and most cPanel hosts, a free Let's Encrypt certificate is requested automatically once the domain resolves, typically within a few minutes.
3. Wait for validation. The authority confirms control using an HTTP check (a file at your domain) or a DNS check (a TXT record). Managed hosts handle this silently; on your own server, Certbot does it.
4. Force HTTPS. Turn on the "always use HTTPS" or "force SSL" toggle so anyone hitting the http:// version is redirected to https://. Without this, both versions load and some visitors stay on the insecure one.
5. Confirm the padlock. Load the site in a private window, check for the padlock, and make sure there are no "mixed content" warnings from images or scripts still loading over http://.

How do I add SSL on my own server with Let's Encrypt?

If you manage your own server rather than a hosted platform, install SSL with Certbot, the standard free client for Let's Encrypt. Certbot requests the certificate, proves control of the domain over the ACME protocol, installs the certificate into your web server (Nginx or Apache), and configures the HTTPS redirect. It also sets up automatic renewal, running a check twice a day and renewing when a certificate is within 30 days of expiry. This is the manual path, and it is still free; you are only paying with a few minutes of setup.

How long is an SSL certificate valid, and do I have to renew it?

Let's Encrypt certificates are valid for 90 days, and renewal is meant to be automatic. That short window sounds inconvenient, but the point is that every host and client is built to renew on a schedule without you touching it, which is more secure than a certificate that sits unchanged for a year. On managed platforms you never think about it. On your own server, Certbot's timer renews within the last 30 days of validity. The only time renewal fails is when the domain stops pointing at the server or the domain itself lapses, which is one more reason to keep the name registered and renewing.

Does HTTPS help SEO?

Yes. Google confirmed HTTPS as a lightweight ranking signal in 2014 and has only leaned on it harder since, and Chrome flags HTTP pages as "Not secure", which hurts trust and click-through. It is not a magic ranking boost on its own, but an unsecured site starts at a disadvantage that is trivial to fix. If you are moving to a new domain or launching one and want to build search rankings on it properly, serving everything over HTTPS from day one removes one of the easiest reasons Google has to hold you back. Our guide on changing your domain name later covers the rest of a clean migration.

Why does my site still say "Not secure" after installing SSL?

The usual cause is that HTTPS is not being forced, or the page loads some resources over plain http://. First, turn on the force-HTTPS setting so the insecure version redirects. Then check for "mixed content", which happens when an image, script, or stylesheet is still hardcoded to an http:// URL; update those to https:// or protocol-relative links. If the certificate was just issued, give it a few minutes and reload in a private window, because your browser may be caching the old insecure version. If the domain only recently started pointing at the host, the certificate may not have finished issuing yet.

The bottom line on SSL and HTTPS for a new domain

Securing a new domain is now a solved problem: point the domain at your host, let it issue a free Let's Encrypt certificate, force HTTPS, and confirm the padlock. You almost never pay, renewal is automatic, and the payoff is a site visitors trust, a checkout that works, and one fewer thing dragging on your search rankings. Once the name is secured you can focus on the site itself. If you are still choosing the domain, browse our brandable names for sale, and if you want the DNS side straight first, read our guide to DNS records.