Free TLS Certificates for WordPress on a Cloud VM

by siteadmin

Prerequisites before you issue anything

Your DNS A and AAAA records must already point at the instance, and port 80 must be reachable from the public internet. Certificate issuance validates control of the hostname; if the record is still propagating, wait rather than retrying and burning through rate limits.

Issue and verify

Certbot can read your web server configuration and install the certificate in one pass. After it succeeds, request the certificate in a browser and inspect the chain, then confirm the renewal timer is active.

sudo certbot --nginx -d wordpressmentor.com -d www.wordpressmentor.com
sudo systemctl list-timers | grep certbot

Then fix WordPress itself

A valid certificate does not fix hardcoded http:// URLs stored in the database. Update the site address, then search for mixed-content references in old posts and widget markup. A single insecure image or script will downgrade the padlock and, in some browsers, block the resource entirely.

  • Set both the WordPress Address and Site Address to https.
  • Add a canonical 301 redirect from http to https and from the non-canonical hostname.
  • Enable HSTS only after you are certain every subdomain supports TLS.
  • Re-run a crawl for mixed content after importing old content.

Leave a Comment