On WebFulHost plans the SSL certificate is installed automatically. Most of this guide is about the second half: making sure every page actually loads over https://, and fixing the leftover http bits that cause the "not fully secure" warning.
1. Confirm your certificate is live
- Log into cPanel.
- Open SSL/TLS Status (under Security).
- Find your domain in the list. It should show the certificate as issued and covering your domain.
If the domain isn't listed, the auto-issuance needs the domain pointed at WebFulHost first (see How to Change Nameservers). Certificates issue shortly afterwards.
2. Try your site over https
Visit https://yourdomain.com (note the https). If it loads with a padlock, the certificate works. Now the trick: unless you redirect, visitors arriving at the old address will still load the plain-text version — send them onward with the next step.
3. Force HTTPS
cPanel includes a one-click option. Open Domains in cPanel and find your domain; in the Force HTTPS Redirect column enable the toggle. That's it — every http request now jumps to https automatically.
Alternatively (or for WordPress sites), add this to .htaccess in public_html:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]
4. Fix the "not fully secure" warning
After forcing HTTPS, browsers may still show a grey or broken padlock. That means parts of the page are loading over http — images, scripts, CSS. Read Mixed Content Warnings Explained to clear them up.
5. WordPress: update the site URL
If you use WordPress, also update its two address settings (Site Address and WordPress Address) to https://yourdomain.com under Settings > General. This stops the editor from generating http links in new content.