Security

Free SSL Certificates

Automatic SSL certificate installation and renewal for every domain, powered by Let's Encrypt. Your site is served securely over HTTPS from the moment your DNS resolves — no configuration required.

  • Let's Encrypt included
  • Auto-renewal
  • Forced HTTPS
Certificate active
Auto-renews
How It Works

HTTPS, fully automated

From issuance to renewal, SSL is handled for you from the moment you connect a domain.

Automatic Issuance

As soon as your domain's DNS points to our servers, a certificate is issued automatically via Let's Encrypt — nothing to configure.

Automatic Renewal

Certificates renew themselves before they expire. You will never see a browser warning from an expired SSL certificate.

HTTPS Enforced Everywhere

All HTTP traffic is redirected to HTTPS at the server level before WordPress is even involved, so your site is always served securely.

www & Non-www Covered

Add both example.com and www.example.com and each gets its own certificate — set one as primary and the other redirects automatically.

Good to Know

Connecting a domain and getting verified

DNS Verified Badge

Your Domains tab shows a "DNS verified" badge once your A record correctly points to our servers — that's when the certificate is issued.

Propagation Time

DNS changes typically propagate within 5–30 minutes, after which the certificate is issued automatically without any action from you.

Stuck Verification

If verification is stuck, check for a conflicting CNAME record or a Cloudflare proxy (orange cloud) that may be masking your real server IP.

FAQ

Common questions about SSL

No. Every domain connected to XeroWP gets a free SSL certificate from Let's Encrypt automatically — there's no purchase or configuration needed.

Nothing — it renews automatically before expiry. You don't need to track renewal dates or take any manual action.

Make sure your A record points to the IP address shown in your Domains tab, and check for a conflicting CNAME record or a Cloudflare proxy (orange cloud) that might be hiding your real server IP from our verification.

Yes. All HTTP requests are redirected to HTTPS at the server level, so visitors always reach your site over a secure connection even if they type the plain http:// address.

Get free, automatic SSL for your domain

No credit card required

Every site includes automatic HTTPS with zero configuration — try it free for 7 days.

14-day money-back guarantee, no questions asked

Already hosting elsewhere? We'll migrate your site free.