Free SSL Certificate: Enable HTTPS and Fix Not Secure

Published 2026-11-01 · 6 min read

If Chrome shows "Not secure" next to your business website address, your site is running without an SSL certificate. The good news: fixing it should not cost you anything. A free SSL certificate from Let's Encrypt is enough for most websites, whether it is a clinic in Mansoura or a clothing shop in Nasr City. This guide explains what SSL and HTTPS actually are, how the certificate types differ, how certificates are issued and renewed automatically, and how to clean up the usual problems after you switch.

What is an SSL certificate and what does HTTPS mean?

An SSL certificate (technically TLS these days) is a small file installed on the server that does two jobs. First, it encrypts the traffic between a visitor's browser and your site, so nobody on the same café Wi-Fi can read a password or phone number typed into your contact form. Second, it proves identity: the browser checks it is really talking to the domain in the address bar and not an impostor.

With a valid certificate your site loads at https:// instead of http://, and the browser shows a padlock or settings icon instead of the "Not secure" label.

Why HTTPS matters for a small business

Trust: many visitors leave as soon as they see a security warning, especially on booking or checkout pages.
Google: HTTPS is a ranking signal, and Google prefers to show the secure version of your pages.
Online payments: payment gateways such as Paymob expect your store pages to run on HTTPS.
Modern browser features: geolocation, notifications and several mobile features only work on secure origins.
Safer logins: on WordPress, your admin password travels encrypted instead of in plain text.

Certificate types: DV, OV and EV in plain words

All three provide essentially the same encryption. What differs is how much the issuer verifies before issuing:

Type	What is checked	Good for
DV (Domain Validated)	Only that you control the domain; automated, takes minutes	Most sites: small companies, clinics, blogs, online stores
OV (Organization Validated)	The domain plus the company's legal existence	Organizations that want their name inside the certificate details
EV (Extended Validation)	A deeper review of company records	Large entities with specific compliance requirements

Modern browsers no longer show the company name prominently for EV certificates the way they used to, so to an ordinary visitor the padlock looks the same. That is why a free DV certificate is the practical choice for most businesses in Egypt and the Gulf.

Let's Encrypt: a free SSL certificate with auto-renewal

Let's Encrypt is a non-profit certificate authority that issues free DV certificates trusted by every major browser. Its certificates are short-lived (around 90 days) on purpose, for security reasons, and the server renews them automatically well before they expire, so there is no date to remember.

Issuance works like this: the server requests a certificate for a domain, and Let's Encrypt checks that the domain really points to that server (by fetching a temporary file from the site). If DNS is right, the certificate arrives within moments. If not, the request fails. That is why almost every SSL problem comes back to one thing: your DNS records.

If your current host charges you yearly for a basic DV certificate on a small company site, you are most likely paying for something that is available for free with essentially the same protection.

How SSL works on Orderatk

On Orderatk web hosting there is nothing to install by hand:

Your free address is HTTPS from day one. When you sign up you get an address like yourname.orderatkeg.com that already works over HTTPS, so you can build and test before connecting a domain.
Connect your own domain. At your domain registrar, add an A record for @ pointing to 87.98.131.73 and a CNAME record for www pointing to yourname.orderatkeg.com. The full walkthrough is on the connect your domain page.
Press "Check now". In Websites › Domains, run the check. Once the records are confirmed, a free Let's Encrypt certificate is issued automatically and renewed automatically after that.
WordPress follows the domain. If your site runs on our WordPress hosting, the WordPress URL is switched to the new domain automatically.

The same applies to sites made with the drag-and-drop website builder and to online stores: the certificate is part of the service, not a paid add-on.

Redirect http to https

Having a certificate is not enough; every visitor should land on the secure version, even if they type the old address or tap an old link shared on Facebook. That is a permanent (301) redirect from http to https, ideally also settling on one version, with or without www.

On modern servers the redirect is part of the server configuration, which is better than relying on a plugin.
In WordPress, make sure both "WordPress Address" and "Site Address" under Settings › General start with https://.
If old page paths changed, the Redirection plugin helps you set up page-by-page 301 redirects.

Test it yourself: type http://yourdomain.com and confirm it jumps to https://. Then try the www version too.

Fixing mixed content in WordPress

The most common post-SSL problem: the site loads on HTTPS but the padlock is incomplete or the browser says the connection is not fully secure. Usually the secure page is loading an image, stylesheet or script from an http:// URL. This is called mixed content.

How to find it

Open the page in Chrome, press F12 for developer tools, and go to the Console tab.
Look for "Mixed Content" messages; each one names the offending URL.

How to fix it

General settings: both site URLs must start with https.
Old links inside posts: images uploaded before the switch are stored in the database with http URLs. Use a reputable search-and-replace plugin to change http://yourdomain.com to https://yourdomain.com, and take a backup first.
Theme and page builder: some older themes hard-code http links. Update the theme, or use Elementor's built-in URL replacement tool if you build pages with it.
Pasted embed codes: maps, videos and ad pixels pasted by hand must use https URLs.
Cache: clear the cache (for example WP Super Cache) and recheck.

On Orderatk you can try these changes on a hidden staging copy of your site first and then push them live; a backup is taken automatically before the push.

Update Google Search Console

Google treats http and https as separate versions of your site. To keep your reporting intact:

Add your site to Google Search Console as a Domain property (verified with a TXT record), which covers every version at once, or add the https:// version as a new property.
Submit your sitemap with the secure URL. The Orderatk builder creates one automatically; on WordPress, Rank Math or Yoast SEO does it.
Check the Pages report after a few days to confirm the new URLs are being indexed.
Update your link on Facebook, Instagram, WhatsApp Business and Google Maps.

Common errors that block a free SSL certificate

1. The domain is not pointing to the server

By far the most common cause. The A record still points to the old host, or there are two A records for the same name (old and new), so validation fails intermittently. Delete the old one. DNS changes can take anywhere from minutes to hours to spread. For a full explanation, read DNS records explained: A, CNAME, MX and TXT.

2. The www record is missing

yourdomain.com works but www.yourdomain.com errors or shows a certificate warning. Add the www CNAME record and press "Check now" again.

3. A CAA record blocks Let's Encrypt

A CAA record lists which authorities may issue certificates for your domain. If someone added one that only allows another issuer, Let's Encrypt will refuse. Remove it, or add one that allows letsencrypt.org.

4. A proxy is enabled on the DNS record

Some DNS panels offer to route traffic through a proxy service, which makes the domain resolve to a different address and breaks validation. Turn the proxy off for the website records until the certificate is issued.

5. The visitor's clock is wrong

If only one customer sees a certificate error, their device date is probably off. Ask them to set date and time automatically.

6. The old certificate still shows

Right after a move, browsers may show the previous host's certificate for a while because of caching and DNS propagation. Wait, then test from mobile data. If you are moving now, see how to move your website to new hosting without downtime.

Quick checklist after enabling SSL

The site opens on https with and without www.
Typing http redirects to the secure version.
No Mixed Content messages in the Console.
Contact forms and checkout pages work normally.
Search Console updated and sitemap submitted.
Links on social profiles and printed cards updated.

SSL protects your website, but it will not stop your email from landing in spam; that is a different topic covered in why your emails go to spam: SPF, DKIM and DMARC. If you are still deciding where to host, read how to choose web hosting in Egypt.

The bottom line

There is no reason for a business website to show "Not secure" today. A free SSL certificate from Let's Encrypt gives you the encryption you need; what matters is correct DNS and automatic renewal, followed by a quick pass over mixed content, redirects and Search Console. If you would rather have all of this handled without touching technical settings, try building your business website on Orderatk: a secure address from minute one, a certificate for your own domain issued and renewed automatically, with hosting and email in one place. See the plans on the pricing page.

FAQ

Is a free SSL certificate as secure as a paid one?

Yes in terms of encryption. Paid OV and EV certificates add company verification, not stronger encryption, so a free certificate is enough for most sites and stores.

Why does Chrome say my site is not secure?

Either the site has no SSL certificate or the page loads images or files over http. Enable the certificate, fix mixed content and redirect http to https.

How long does a Let's Encrypt certificate last?

About 90 days, but the server renews it automatically before it expires, so on Orderatk you never renew it by hand.

Why did my SSL certificate fail to issue?

Usually the A record points to the wrong server or an old duplicate record remains, the www record is missing, or a CAA record does not allow Let's Encrypt.

Does HTTPS help SEO?

Google uses HTTPS as a ranking signal and prefers secure pages, and it improves visitor trust. Update Search Console and your sitemap after switching.

Ready to start?

Start your free trial