Question 1

Do I actually need SSL on my WordPress site?

Accepted Answer

Yes, without exception. Chrome and every other modern browser flag non-HTTPS sites as 'Not Secure', Google ranks HTTPS sites higher, and any form on a non-HTTPS page (including a simple contact form) shows an alarming warning to visitors. SSL is free, takes an hour to set up properly, and there's no reason any WordPress site in 2026 should be without it.

Question 2

What's the difference between Let's Encrypt, paid SSL, and Cloudflare SSL?

Accepted Answer

Let's Encrypt: free, automated, 90-day certificates that auto-renew. Fine for every brochure site and most ecommerce. Paid SSL (Sectigo, DigiCert): typically £30–£300/year for an Organization Validated or Extended Validation certificate that shows your company name. Useful for enterprise or finance sites where the certificate is part of trust signalling. Cloudflare SSL: free, terminates at Cloudflare's edge, requires Cloudflare to be in front of your site. All three secure traffic equivalently from a cryptographic standpoint.

Question 3

What is TLS 1.3 and do I have it?

Accepted Answer

TLS 1.3 is the modern version of the protocol behind HTTPS. It's faster (one round trip for handshake instead of two), more secure (deprecates old cipher suites), and supported by every modern browser. Most hosts and CDNs default to TLS 1.3 now, but plenty of older WordPress hosting setups still default to TLS 1.2. We check and enable 1.3, and disable old protocols (TLS 1.0/1.1, SSLv3) that fail security scans.

Question 4

How do I migrate an existing HTTP site to HTTPS without breaking things?

Accepted Answer

Three steps that need to happen in the right order. First, install the SSL certificate and verify HTTPS works on the front and back end. Second, run a search-and-replace across the database to update every http:// URL to https:// — covering posts, options, postmeta and serialised data. Third, add a 301 redirect from HTTP to HTTPS at the server level. Done wrong, you get mixed-content warnings (some assets still loaded over HTTP) or redirect loops. We handle all three carefully.

Question 5

What is HSTS and should I enable it?

Accepted Answer

HTTP Strict Transport Security is a header that tells browsers to only ever connect to your site over HTTPS, even if the user types http://. It prevents downgrade attacks and is required for top SSL Labs scores. Enable it only once you're confident HTTPS is working everywhere — once HSTS is set with a long max-age, you can't easily go back to HTTP.

Question 6

Will SSL slow my site down?

Accepted Answer

No. The opposite, in fact. HTTPS is a prerequisite for HTTP/2 and HTTP/3, both of which are significantly faster than HTTP/1.1. The TLS handshake adds maybe 20ms once per connection, and is then amortised across every subsequent request. The performance gains from HTTP/2 multiplexing far outweigh the handshake cost.

Question 7

What about wildcard certificates for subdomains?

Accepted Answer

Let's Encrypt issues free wildcard certificates (*.yourdomain.com) via DNS validation. Useful if you have many subdomains (shop., blog., app., staging.) and don't want to manage a certificate per subdomain. We set them up where they make sense.

Question 8

How much does setup cost?

Accepted Answer

New SSL setup with proper migration, mixed-content fixes, HSTS and TLS 1.3 hardening: £200–£400. Free Let's Encrypt certificates included; only paid OV/EV certificates have ongoing cost.

SSL setup for WordPress, done properly.

What you get

Free or paid SSL

HTTP-to-HTTPS migration

Mixed-content fix

TLS 1.3 + HTTP/2 + HTTP/3

HSTS hardening

SSL Labs A+ verification

Tell me about your project.

What service do you need?

How it works

Provision

Migrate

Harden

Verify

Related services

Free 30-minute consultation

Frequently asked questions