Set up an SSL certificateFree with Let's Encrypt

Published on October 20, 2026

Why HTTPS is a must

HTTPS encrypts the connection between visitor and server. Without a certificate, transmitted data can be read along the way - with a contact form or a login, that is a real problem, and from a data protection perspective, unencrypted transmission of personal data is not defensible.

There are also two practical reasons: browsers visibly mark sites without a certificate as "not secure", which puts visitors off. And HTTPS has been a ranking factor at Google for years.

Prerequisite: the domain must point to the web hosting

Let's Encrypt only issues a certificate if the domain demonstrably belongs to this server. The verification runs automatically, but requires that the DNS records already point to your web hosting.

If you request the certificate too early - for example in the middle of a move, while the domain is still with the old provider - issuing fails. In that case, wait for the DNS switch; how it works is described in the guide Connect a domain to your web hosting.

Issue a certificate in Plesk

1. In Plesk, open the desired domain and go to SSL/TLS Certificates.
2. Click Install for Let's Encrypt.
3. Enter an email address for expiry notifications.
4. Enable the option for www so that the certificate applies to both yourdomain.com and www.yourdomain.com. Without it, the browser warns on one of the two variants.
5. If you use mail accounts under this domain, also select the protection for webmail and the mail server.
6. Click Get it free. After a few seconds, the certificate is active.

Renewal runs automatically. Let's Encrypt certificates are valid for 90 days and are renewed by Plesk in good time beforehand - you do not have to take care of it.

Enforce HTTPS

An installed certificate alone is not enough: without a redirect, your site remains reachable via http:// as well. That creates duplicate addresses for the same content and allows unencrypted access.

In Plesk, you enable the permanent redirect from HTTP to HTTPS in the domain's hosting settings. All requests then reliably land on the encrypted variant.

Switch WordPress and other CMS

Content management systems store their own address in the database. After the SSL switch, you have to adjust it there:

• WordPress: under Settings > General, set both fields - WordPress Address and Site Address - to https://.
• Joomla and others: switch the base URL to HTTPS in the respective configuration.

Afterwards, old addresses often remain in posts and settings. A search-and-replace run over the database replaces http://yourdomain.com with https://yourdomain.com. Take a backup first - such mass changes can hardly be undone otherwise.

Eliminate mixed content

If the browser does not show a closed padlock despite a valid certificate, it is almost always down to "mixed content": the page itself is loaded encrypted, but individual images, stylesheets or scripts are still loaded via http://.

How to find the cause: open the page in the browser, open the developer tools and look in the console for warnings about insecure content. The specific file is listed there. Typical sources are hard-coded image paths in older posts, embedded fonts and scripts from third parties and theme settings with stored logo URLs.

Typical error messages

• Issuing fails: the domain does not point to the web hosting yet, or an existing redirect prevents the check. Check the DNS records first.
• Warning only for www: the certificate was issued without the www variant. Simply request it again and enable the option.
• Redirect loop: HTTPS is enforced at the same time in Plesk, in .htaccess and in the CMS. Let exactly one place handle the redirect - which one makes sense and how to clean up the other rules is described in .htaccess & redirects.
• Certificate expired: automatic renewal failed, usually because the domain temporarily no longer pointed to the server. After correcting the DNS records, request it again manually once.

Frequently asked questions