The padlock in the address bar is one of those things visitors only notice when it's missing. It means the connection between your visitor and your site is encrypted, that the page wasn't tampered with on the way, and — increasingly — that browsers and search engines treat your site as trustworthy at all. On CloudPerch that padlock is free, automatic, and self-renewing. This guide explains how it works and what to do on the rare occasions it doesn't show up right away.

How SSL works here

You don't request a certificate, pay for one, or remember to renew it. When a site exists and its address resolves to us, a certificate is issued for it automatically, and it renews itself well before it expires. There are no buttons to press.

Two cases are worth separating:

  • Your *.cloudperch.io subdomain is secured immediately. Because that address already points at us, there's no waiting — your instant subdomain is served over https:// from the moment the site exists.
  • A custom domain's certificate issues once DNS resolves. When you connect your own domain, the certificate can only be issued after the domain actually points at CloudPerch. Once DNS resolves, issuance usually happens within a few minutes, and the padlock appears on its own.

The certificate follows the DNS. If a custom domain isn't showing a padlock yet, the question to ask first is almost always "is my DNS actually pointing here yet?" — not "is something wrong with the certificate?"

"Not secure" on a new custom domain

If you just connected a domain and the browser says Not secure, this is almost always normal and temporary. The certificate is waiting on DNS.

Work through this in order:

  1. Give it a few minutes. DNS changes take time to settle, and the certificate can't issue until they do.
  2. Confirm your DNS is pointing at CloudPerch using the records shown in your dashboard. A wrong or missing record is the most common cause. See connect an existing domain for the exact values.
  3. Check both www and the bare domain. If only one resolves, only one will get a certificate. Both should point at us.
  4. Reload in a private window. Browsers cache aggressively; a fresh window rules out a stale page.

Once DNS resolves cleanly, the certificate provisions itself and the warning clears. If it's been well past a few minutes and DNS looks right, get in touch and we'll take a look.

Force HTTPS everywhere

Once your certificate is live, you want every visitor on https://, not the unencrypted http://. There are two halves to this.

Tell WordPress its address is HTTPS. In Settings → General, make sure both the WordPress Address and Site Address start with https://. This stops WordPress from generating insecure links to itself.

Redirect old links. Visitors and search engines may still have http:// links to your pages. A redirect sends them to the secure version automatically. Many security and caching plugins offer a one-click "force HTTPS" toggle, which is the simplest route for most sites.

Fix mixed-content warnings

Sometimes a page loads over HTTPS but the padlock looks broken or the browser warns about mixed content. That means the page itself is secure, but it's pulling in a resource — an image, a script, a font — over plain http://. The browser flags the whole page because one ingredient arrived unencrypted.

To track it down and fix it:

  1. Open the page and check your browser's developer console — it names the exact http:// resources causing the warning.
  2. Most often it's a hard-coded image or embed in a post. Edit it to use https:// (or a protocol-relative // URL).
  3. For links scattered through old content, a reputable "better search replace" plugin can swap http://yourdomain for https://yourdomain across the database in one pass.
  4. Take a snapshot before a database-wide search-and-replace, so a bad run is a quick rollback.

After fixing the offending resources, reload in a fresh window. The full padlock should return.

Where to go next

SSL is one of the things that should fade into the background once it's set. To keep the rest of your domain setup tidy:

If the padlock still won't appear after DNS has clearly resolved, our team is a short message away on the contact page.