How to Install an SSL Certificate on HostGator

An SSL certificate protects the connection between a visitor’s browser and your website. Once installed, it enables HTTPS, encrypts information such as passwords and payment details, and gives visitors the familiar padlock shown in Chrome, Safari and other browsers. Modern certificates use Transport Layer Security (TLS), although “SSL” remains the term most hosting customers recognise.

HostGator customers can usually activate HTTPS through cPanel without manually purchasing or uploading a certificate. The exact screen names may vary between hosting packages, but the process follows the same pattern: point the domain to HostGator, allow the certificate to issue, confirm that HTTPS works, and redirect visitors from the old HTTP address.

Check Your Domain And Hosting Setup

Before installing a certificate, confirm that the domain is connected to the correct HostGator account. A certificate can only be issued when the domain resolves to the server that is requesting it. If you have recently moved a domain, review this guide to transfer an existing domain before troubleshooting SSL.

Log in to the HostGator customer portal and check the hosting package associated with your website. Open cPanel using the customer access link, then look for a section named Security, SSL, or SSL/TLS Status. Shared hosting plans commonly include an automatic SSL service, while some specialised or older packages may require a separate certificate installation.

Check the main domain, any www version, and relevant subdomains. For example, a business may use example.com.au for its website, shop.example.com.au for an online store, and mail.example.com.au for a separate service. Each hostname that visitors use may need its own valid certificate or coverage through a suitable multi-domain certificate.

DNS changes can take time to appear across the internet. Australian visitors using NBN connections in Melbourne, Sydney or Brisbane may see the new destination at a different time from customers on mobile networks in Perth or regional areas. Wait until the domain consistently resolves to HostGator before treating a certificate issuance error as a hosting fault.

Use HostGator Automatic SSL

For many HostGator accounts, the easiest method is AutoSSL. In cPanel, open SSL/TLS Status and locate the domain. Select it if necessary, then use the Run AutoSSL or similar option. HostGator will attempt to verify domain ownership, issue a certificate and install it on the relevant virtual host.

Some accounts process automatic certificates on a schedule rather than immediately. If the certificate does not appear straight away, allow several hours and check the status again. A successful result normally shows a padlock, a certificate issuer and an expiry date beside the domain. The precise certificate authority may differ according to HostGator’s current systems and your plan.

Automatic issuance can fail when the domain uses incorrect DNS records, a proxy service blocks validation, or a CAA record restricts which certificate authorities may issue certificates. Temporarily review DNS settings and confirm that the website’s A record points to the correct HostGator server. Do not remove security records without understanding their purpose, particularly if the domain also supports email or other services.

A certificate for the root domain may not automatically cover every subdomain. Test both https://example.com.au and https://www.example.com.au, along with any hostname used for a store, booking system or customer portal. If one version is unprotected, update the certificate coverage or ask HostGator support to check the account’s AutoSSL configuration.

Install A Certificate Manually

Manual installation is generally needed when you bought a third-party certificate, received certificate files from an organisation, or are moving a certificate from another server. You will normally receive a certificate file containing the public certificate, a private key generated with the certificate request, and sometimes a CA bundle or intermediate certificate.

In cPanel, open SSL/TLS and choose Install and Manage SSL for your site, or a similarly named certificate-management tool. Select the domain, then paste the certificate into the CRT field, the matching private key into KEY, and the intermediate chain into CABUNDLE when HostGator provides separate fields. Some cPanel versions can automatically fetch the matching key and certificate after you enter the domain.

The private key must match the certificate exactly. If cPanel reports that the key does not correspond to the certificate, do not keep trying random files. Locate the original certificate signing request and private key, or contact the certificate provider. A private key should never be emailed publicly, posted in a forum or stored in an unsecured shared document.

After saving the certificate, visit the site over HTTPS and inspect the browser’s certificate details. Confirm the domain name, validity dates and issuing authority. If the browser reports an incomplete chain, install the correct CA bundle supplied by the certificate provider. An invalid chain may affect some Android devices, older browsers and visitors using managed workplace networks.

Force Visitors To Use HTTPS

Installing the certificate does not always redirect old HTTP links automatically. A visitor can still type http:// unless the website or server sends a permanent redirect to HTTPS. cPanel may include a Force HTTPS Redirect switch in Domains. Enable it for the correct domain after confirming that HTTPS loads normally.

For WordPress websites, the site address and WordPress address should use https://. These settings are commonly available under Settings and General, although a hosting migration or plugin may require a different approach. Change one setting at a time and retain administrator access so you can reverse a mistake.

Apache websites may use an .htaccess rule to redirect HTTP traffic. The correct rule depends on the server configuration, existing rewrite rules and whether a proxy is in use. Avoid pasting several competing redirect snippets because they can create loops, slow page loads or make the website unavailable. Make a backup before editing the file.

A permanent redirect also helps search engines consolidate the HTTP and HTTPS versions of a page. Update internal links, canonical tags, XML sitemaps and advertising destinations where possible. If a local Australian business has its website listed on Google Business Profile, industry directories or printed marketing material, the new HTTPS address should become the preferred public URL.

Fix Browser Warnings And Mixed Content

A site can have a valid SSL certificate and still show a warning because the page loads images, scripts, fonts or stylesheets over HTTP. This is called mixed content. Browsers may block insecure scripts or display a warning symbol even though the main domain has a valid certificate.

Use the browser developer console or a reputable SSL checker to identify insecure resources. Replace hard-coded http:// links with HTTPS, update theme and plugin settings, and check embedded content from payment providers, maps, booking platforms or social media services. Older plugins may contain fixed HTTP references that require an update or a small code change.

Clear website caches and content delivery network caches after making changes. Test in a private browser window as well as on a phone. Australian customers often move between home NBN, office Wi-Fi and mobile data during the day, so a page that works on one connection should be checked on several devices and networks.

Email settings are separate from the website certificate. If you use HostGator email, configure SPF and DKIM so receiving servers can verify messages sent from your domain. The guidance on SPF and DKIM records can help prevent legitimate mail from being treated as spam, but it does not replace HTTPS or encrypt website traffic.

Keep The Certificate Working

SSL certificates have an expiry date, so check whether HostGator is renewing the certificate automatically. Automatic renewal requires the domain to remain pointed correctly and the validation process to remain available. DNS changes, firewall rules, expired payment details or a newly added CAA policy can interrupt renewal.

Add the certificate expiry date to your website maintenance calendar even when AutoSSL is enabled. A reminder several weeks before expiry gives you time to investigate. A certificate that expires during an Australian public holiday or a busy retail period can cause lost sales, especially for shops serving customers across different time zones.

HTTPS protects data while it travels between the browser and the server, but it does not make the whole website secure. Keep cPanel, WordPress, plugins, themes and custom applications updated. Use strong, unique passwords, enable multi-factor authentication where available, and remove unused administrator accounts. Regular backups should be stored separately from the hosting account.

Australian businesses should also consider how web security fits with their privacy responsibilities. The Privacy Act 1988 and the Australian Privacy Principles may apply when a business collects personal information, while payment providers often impose their own security requirements. An SSL certificate supports safer transmission, but it does not by itself satisfy every privacy, breach-response or payment obligation. Obtain professional advice for a business-specific assessment.

Once HTTPS is active, review the complete customer journey: homepage, contact forms, account login, checkout, downloads and email links. Confirm that redirects work, forms submit successfully and no browser warnings remain. Keep a record of the domain, certificate method, renewal status and any custom DNS settings.

Open HostGator cPanel now, go to SSL/TLS Status, and run AutoSSL for the domain you want to secure.