Every Bluehost plan comes with a free SSL certificate already active, no signup step required. I cover where to find it, what the free tier actually covers, when a paid upgrade makes sense, and how to check if your site still shows “Not Secure” despite having SSL enabled.
This guide assumes you already have a Bluehost account with an active website. If you are still deciding whether to sign up, our full Bluehost review covers hands-on performance and support testing, and our Bluehost coupons page tracks current signup discounts.
Your Free SSL Certificate Is Already Active
Bluehost issues a free SSL certificate automatically once your domain is connected and pointed to Bluehost’s nameservers. You do not need to request it or turn it on. To confirm it is working:
- Log in to your Bluehost Account Manager
- Click Websites in the left sidebar
- Click Manage Site next to the site you want to check
- Click the Security tab
You will see an SSL Certificates card showing your current tier, labeled Basic by default, along with a status indicator. If it reads Secure, your site is already serving traffic over HTTPS.
SSL Certificates vs SSL Manager: Two Different Cards
The Security tab shows two separate panels that are easy to confuse.
SSL Certificates tracks which certificate tier you currently have (Basic, or an upgraded paid tier) and its status. Click the three-dot menu on this card to reach three additional tools:
- View SSL logs, useful for checking certificate issuance or renewal history if something is not working as expected
- Generate CSR, which creates a Certificate Signing Request. You need this if you are purchasing a certificate from an external certificate authority rather than through Bluehost directly
- Upload SSL, for installing a certificate you purchased or generated elsewhere instead of using Bluehost’s own
SSL Manager opens a separate page listing every domain and subdomain connected to your account, including any temporary or staging URLs, with its own row for Certificate type, Status, and Expires.
Every entry we checked was issued through Let’s Encrypt and showed a Secure status, expiring roughly two to three months out, consistent with Let’s Encrypt’s short renewal cycle.
This is the page to check if you manage several domains or subdomains and want to confirm all of them are actually covered, rather than assuming coverage extends automatically.
From here, the Add SSL button offers Import an SSL, for adding a certificate you already obtained from another provider, which functions the same way as the Upload SSL option on the SSL Certificates card.
Should You Upgrade Past the Free Certificate?
The free Basic certificate, issued through Let’s Encrypt, covers the standard case. It encrypts traffic between your visitors and your site and satisfies the padlock and HTTPS requirement that both browsers and search engines expect.
For most blogs, small business sites, and personal projects, this is enough on its own.
An upgrade makes more sense if you need:
- Wildcard coverage, so a single certificate secures unlimited subdomains rather than just your root domain and www
- Organization or Extended Validation (OV/EV), which verifies your business identity and can display additional trust signals, more relevant for ecommerce or finance-adjacent sites handling sensitive transactions
- A specific certificate authority your business or compliance requirements call for, which is where Generate CSR and Upload SSL come in
To browse upgrade options, click Upgrade directly on the SSL Certificates card, or go to Security in the left sidebar and open the SSL Certificates tab there, which is separate from Malware Protection on the same page and leads to an Add SSL Certificates purchase flow.
Tip: If you only need to secure a handful of subdomains rather than unlimited ones, check whether adding each as its own connected domain gets its own free certificate before paying for wildcard coverage. It is not always necessary.
Why Your Site Might Still Show “Not Secure”
This is one of the most common frustrations people run into even with SSL active. A few likely causes:
- Mixed content. Your page loads over HTTPS, but some images, scripts, or stylesheets on the page are still being pulled in over plain HTTP. Browsers flag this even though the main connection is encrypted. Check your site’s source or use your browser’s developer console to spot resources still loading over HTTP
- The certificate has not finished issuing yet. If you just connected a new domain, allow some time for the free certificate to be issued before assuming something is broken
- Caching. Both browser and CDN-level caching can serve an old, cached version of a page that predates the certificate going live. Clear your cache or check in a private browser window
- DNS not fully pointed to Bluehost. If your domain’s nameservers or A record are not correctly pointed here, the certificate has nothing valid to attach to
If none of that resolves it, the View SSL logs option on the SSL Certificates card is the next place to check, since it will show whether the certificate itself issued and renewed correctly.
Force HTTPS Is Not a Self-Service Toggle
Many hosts include a dedicated switch to force all traffic to HTTPS, automatically redirecting anyone who lands on the unencrypted version of your site.
Checked directly, neither the SSL Certificates card nor the SSL Manager page includes a setting like this.
If your site is serving both HTTP and HTTPS versions without redirecting, this appears to require a manual redirect, either through a WordPress plugin, a rule added to your site’s .htaccess file, or by contacting Bluehost support directly rather than a switch inside the Account Manager.
