Free SSL Certificate
on Every Plan
Every site on every 365i plan gets a wildcard SSL certificate from Let's Encrypt, issued as soon as your domain points at our nameservers and renewed before it can ever run out. You do not request it, configure it or pay for it.
An SSL certificate that cannot expire on you
A Let's Encrypt certificate is only valid for 90 days. That sounds like a problem and it is the opposite of one, because a certificate with a short life has to be renewed by a machine. Nobody is relying on a diary reminder.
Expiry is the failure this prevents, and it is a nastier failure than people expect. A visitor does not see a message about a certificate needing renewal. They see a full-page red warning that their connection is not private, which looks exactly like the warning they would get on a site that had been compromised. You can check any certificate, including one you hold elsewhere, with our free HTTPS Inspector.
What the free SSL certificate covers
Your domain and every subdomain
It is a wildcard certificate, so one certificate answers for the lot. A site at example.com is covered on www.example.com, on shop.example.com, and on staging.example.com without anybody adding names to anything.
Every site on the plan
Not one certificate per account. If your plan carries several sites, each one gets its own certificate, issued the same way and renewed on the same cycle.
Linux and WordPress alike
This is a platform feature rather than a WordPress one, so Web Hosting and WordPress Hosting both get it, on the same terms, at the same price of nothing.
Because the wildcard covers everything under your domain, a WordPress staging site at staging.example.com is served over HTTPS from the second it exists. There is no separate certificate to think about and no browser warning to click past while you work.
There is one condition, and it is about nameservers
The free wildcard certificate needs your domain to be using our nameservers. That is not a sales requirement, it is how the certificate gets validated: we have to be able to answer for the domain in DNS before a certificate can be issued for it automatically. Point your nameservers somewhere else and we cannot issue it.
You do not have to move the domain to us. Leave it registered wherever it is now and change the nameservers with your current registrar. That is a five-minute job on most control panels and it costs nothing. Transferring the registration is a separate decision, and one you would usually make on price rather than on this: our domain pricing works out cheaper than most registrars, and having the domain and the hosting in one place makes support quicker. Neither of those is a reason to move it today.
If you need to keep DNS elsewhere, for a service that requires its own nameservers, then the free certificate is off the table and a paid one is the answer. That case is covered below.
Do you need to pay for an SSL certificate?
Almost certainly not. There are three situations where a paid certificate earns its money, and if none of them is you then the free one is the right answer.
- Your nameservers have to stay somewhere else. The free certificate can only be issued automatically if the domain uses our nameservers, because that is how it gets validated. The paid GeoTrust certificates carry no such requirement and work whoever runs your DNS.
- Somebody has asked you for a warranty. Payment processors and insurers occasionally require one in writing. A free certificate carries none.
- You want the company checked, on record. An audit trail showing a certificate authority verified your business is a thing you can buy. It is the only one of the three that changes what the certificate actually proves.
Free SSL
£0
- Proves you control the domain
- Wildcard, every subdomain covered
- Issued in seconds, renewed automatically
- Needs 365i nameservers
Simple SSL
From £49.99a year
- Domain Validation, the same thing free proves
- $10,000 warranty from GeoTrust
- Issued in minutes
- Works whoever runs your DNS
Extended SSL
From £275a year
- Extended Validation
- $1.5 million underwritten
- Up to about a week to issue
- Company vetting on record
What each one actually proves
A free certificate proves one thing: whoever asked for it controls the domain. Simple SSL proves exactly the same thing and adds a warranty on top. So the honest comparison between those two is a warranty, and nothing else.
Extended Validation is different in kind. A certificate authority checks that the company legally exists and matches its registered name and address, checks that the person placing the order was authorised by that company to place it, and rings a telephone number it sourced from a public directory rather than from the application form. That is why it takes about a week instead of about a second.
The part the order pages skip
None of that vetting is visible to your visitors. Browsers used to print the verified company name in the address bar, and they stopped: Chrome dropped it in version 77, Firefox in version 70, and Safari had already gone in 2018. A visitor today cannot tell an Extended Validation site from a free-certificate site by looking, because there is nothing left to look at.
So what £275 a year buys is a vetting record and a warranty. Both are real and both are worth having if somebody has asked you for them. Neither is a trust signal your customers will ever see, and we would rather say that plainly than sell you a badge that was retired seven years ago. For nearly everybody reading this, the certificate you already have is the one to keep.
Check your own SSL certificate
Whether your site is with us or not, these will tell you what your certificate is doing.
HTTPS Inspector
Reads the certificate, then scans the page for the mixed content that stops the padlock appearing even when the certificate is fine.
Run the inspector →HTTP Header Inspector
Follows your redirects and grades the security headers that sit alongside the certificate, including HSTS.
Inspect headers →Free SSL certificate questions
Yes. Every 365i plan includes a certificate from Let's Encrypt at no cost, on every site on the account, and there is nothing to add to your basket. It is not a trial and it does not become chargeable later. The paid GeoTrust certificates further down this page are a separate product for the small number of businesses that need a warranty or a vetting record.
Yes. It is a wildcard certificate, so one certificate covers your bare domain and every subdomain under it. A site at example.com gets www.example.com, shop.example.com and staging.example.com from the same certificate, which is why a staging site is served over HTTPS the moment it exists without you asking for anything.
It does not get that far. A Let's Encrypt certificate lasts 90 days and the platform reissues it well before the end of that window, every time, for as long as the site is hosted here. That is the part worth paying attention to. A certificate somebody has to remember to renew is the one that takes a site down on a Sunday, and to a visitor an expired certificate looks exactly like a compromised one. You can check any certificate, including one you hold somewhere else, with our free HTTPS Inspector.
No, as long as your domain is using our nameservers. That is the one condition on the free certificate: we have to be able to answer for the domain in DNS before we can validate it and issue automatically. You do not need to transfer the domain to us to do that. Leave it registered wherever it is and change the nameservers with your current registrar, which takes about five minutes and costs nothing. Moving the registration across is a separate decision, usually made on price, and our domain pricing tends to work out cheaper. If you have to keep DNS elsewhere, the free certificate is not available and a paid GeoTrust certificate is the answer, because those work whoever runs your DNS.
Most people should not. Simple SSL (from £49.99 a year) proves the same thing the free certificate proves, that you control the domain, and adds a $10,000 warranty. Extended SSL (from £275 a year) is the one that is different in kind: a certificate authority checks the company legally exists, checks the person ordering was authorised to order it, and rings a phone number it found in a public directory rather than on your application. That takes about a week and carries $1.5 million. Buy it if an insurer or a payment processor has asked you for it in writing. Otherwise stay on the free one.
No, and anyone selling you one on that basis is selling you something you already have. Google treats HTTPS as a ranking signal, but the signal is HTTPS itself, not what you paid for it. Your free certificate gives you exactly the same HTTPS as a £275 one. What does affect rankings is the rest of your setup, and our HTTPS Inspector will find the mixed content that stops the padlock appearing even when the certificate is fine.
No, and no certificate you can buy will change that. Browsers used to show the verified company name in the address bar on Extended Validation certificates. Chrome removed it in version 77, Firefox in version 70, and Safari had already dropped it in 2018. Since then a visitor cannot tell an Extended Validation site from a free-certificate site by looking, because there is nothing left to look at. What the money buys is the vetting record and the warranty, which are real, and not a visible badge, which no longer exists.
By Mark McNeece, Founder of 365i. Last reviewed 28 July 2026.
Editorial integrity: read our editorial standards.
Every plan already has one
A wildcard SSL certificate from Let's Encrypt, issued automatically and renewed before it can expire, on every site you host with us.
