Which web hosts really include a free SSL certificate?
Six hosts compared on the certificate: which one you get, how many domains it covers, how it renews, and whether it handles wildcards.
The short answer: in 2026 every host on this list gives you a free SSL certificate (the file that puts your site on https and shows the padlock). Free SSL is now standard. The real gap is the wildcard (one certificate for all your subdomains) and what the host tries to sell you on top. Kinsta and IONOS include a wildcard, and SiteGround issues a free Let's Encrypt wildcard when your domain uses its DNS. DreamHost renews Let's Encrypt every 60 days but does not support wildcards at all. Hostinger installs its free certificate on every domain and subdomain in minutes. Bluehost includes Let's Encrypt, then lists paid DV, wildcard and EV certificates right next to it.
Your profile in one line. A blog or a small business site: DreamHost or Hostinger, the free certificate is all you need. Lots of subdomains: IONOS, SiteGround, or Kinsta if you run WordPress and the site makes money. A company that wants its legal identity in the certificate (EV): Bluehost sells one, but read our take on paid DV first.
The ranking is editorial: a sponsored placement is always labeled on its listing, and no affiliate link changes a score.
Who really includes the certificate, and which one?
On a pricing page, "free SSL" hides three different things. A Let's Encrypt certificate installed and renewed on every domain. A host-branded certificate, sometimes wider (a wildcard). Or a basic free certificate with a paid upgrade sitting right beside it. The first column tells you what you get and whether it covers subdomains. The second tells you how it renews and on which plan.
| Included certificate, and wildcard support | Renewal, plan and entry price | |
|---|---|---|
| DreamHostLet's Encrypt, no wildcard | Free Let's Encrypt certificate. Wildcard: not supported, each subdomain is added on its own. | Renewed automatically every 60 days. Launch $2.89/mo the first year, then $10.99/mo. |
| IONOSWildcard included | IONOS DV wildcard certificate included with the hosting packs, unlimited certificates on Ultimate. | Included on every pack. Plus $1/mo the first year, then $14/mo; Essential $4/mo, then $8/mo. |
| SiteGroundFree wildcard with its DNS | Free Let's Encrypt installed and renewed automatically. Wildcard: free Let's Encrypt wildcard when the domain uses SiteGround's DNS; paid Premium Wildcard (GlobalSign) via Marketplace. | Included on StartUp, GrowBig and GoGeek. StartUp $1.99/mo, then $17.99/mo (12 months). |
| KinstaWildcard included, WordPress | Free SSL through the Cloudflare integration, wildcard included: www, non-www and unlimited subdomains. | Renews as long as the _acme-challenge CNAME stays in your DNS. Single 35k $35/mo. |
| HostingerFree SSL for life | Free certificate installed automatically on every domain and subdomain. Wildcard: only as a paid or custom certificate on a VPS. | Free automatic renewal on all plans. Premium $2.49/mo over 48 months, then $10.99/mo. |
| BluehostLet's Encrypt, paid upsells | "Free SSL - Let's Encrypt" on Starter, Business and eCommerce Essentials. Wildcard: paid, Wildcard DV at $19.99/mo. | Paid DV $3.33/mo, then $7.49/mo; EV $19.99/mo (12 months). Starter $3.99/mo over 36 months, then $9.99/mo. |
Prices checked in 2026 on each host's own pages, in US dollars, before tax.
DreamHost
DreamHost does the basics cleanly. Every site gets a free Let's Encrypt certificate, and DreamHost renews it automatically every 60 days. You never see an expiry warning, and you never have to log in to click a button.
That automatic renewal matters more each year. The maximum certificate lifetime dropped to 200 days in 2026, falls to 100 days in 2027 and to 47 days in 2029. Let's Encrypt itself is moving its default from 90 to 64 days in 2027, then to 45 days in 2028. Manual renewal is turning into a chore you cannot keep up with. On DreamHost you simply never touch it.
The limit is clear and DreamHost says it openly: wildcard certificates are not supported. If your site uses shop.yoursite.com, blog.yoursite.com and help.yoursite.com, you add a free certificate to each subdomain one by one. That works fine for three subdomains. It gets tedious for thirty.
Pricing is simple: Launch costs $2.89 a month for the first year, then $10.99 a month. DreamHost also sells a paid certificate, but for a blog or a business site the free one encrypts exactly the same way.
- Free Let's Encrypt on every site
- Automatic renewal every 60 days
- No plan without SSL
- ✓Nothing to renew by hand
- ✓Low first-year price
- ✓Honest about what it does not support
- ✗No wildcard support at all
- ✗Price jumps to $10.99/mo after year one
Our first pick for a small site that just needs the padlock. If you run many subdomains, IONOS covers them with one certificate.
IONOS
IONOS does not lean on Let's Encrypt. Its hosting packs include an IONOS DV wildcard certificate: one certificate that covers your domain and every subdomain under it, including the ones you have not created yet. The top Ultimate pack goes further with an unlimited number of SSL certificates.
That is the feature most shared hosts skip. DreamHost does not support wildcards, Hostinger only offers one as a paid certificate on a VPS, Bluehost sells its Wildcard DV at $19.99 a month. With IONOS it is part of the pack.
Watch the second year. Plus costs $1 a month for the first year, then $14 a month. Essential is $4, then $8. Ultimate is $10, then $18. All on a one-year term, which also means you can leave after a year instead of being locked in for four.
The limit: a host-branded wildcard ties your certificate to IONOS. If you move, you will rebuild your SSL elsewhere, often one subdomain at a time. And before you order a separate OV or EV certificate from IONOS, ask for the exact price in writing.
- DV wildcard certificate in the hosting packs
- Unlimited certificates on Ultimate
- No Let's Encrypt to babysit
- ✓Every subdomain covered in one go
- ✓One-year terms, no long prepay
- ✓Very low first-year price
- ✗Renewal price is several times the intro price
- ✗Separate OV and EV pricing hard to read
The pick if your subdomains keep multiplying. For a single simple site, the wildcard buys you nothing: DreamHost is enough.
SiteGround
SiteGround installs a free Let's Encrypt certificate on your site and renews it automatically. What sets it apart on shared hosting is the wildcard: if your domain uses SiteGround's DNS, you get a free Let's Encrypt wildcard that covers the main domain and every subdomain. That is the condition every free wildcard depends on, since validation runs through a DNS record, and SiteGround handles it for you.
SiteGround offers three types: Let's Encrypt, Let's Encrypt Wildcard, and a Premium Wildcard from GlobalSign ordered through its Marketplace. The Premium Wildcard price is not shown on the page, so ask before you order. For encryption alone, the free wildcard does the same job.
The catch is the renewal. StartUp is $1.99 a month, then $17.99. GrowBig goes from $3.99 to $29.99, GoGeek from $5.99 to $44.99, all on a 12-month term. The first-year price is about a ninth of the renewal: budget for year two before you sign.
Our score reflects that split. On the certificate itself SiteGround sits with IONOS and Kinsta. On the real three-year cost it ranks among the most expensive shared hosts here, which keeps its overall score at 3.7.
- Free Let's Encrypt wildcard with SiteGround DNS
- Automatic install and renewal
- Premium Wildcard from GlobalSign on request
- ✓Free wildcard on shared hosting, rare
- ✓No manual DNS validation to run
- ✓Same SSL on every plan
- ✗Renewal is up to nine times the intro price
- ✗Wildcard tied to using SiteGround's DNS
The pick for a free wildcard on shared hosting if you move your DNS there. If the renewal price hurts, IONOS includes a wildcard for less.
Kinsta
Kinsta is managed WordPress, not shared hosting, and the price shows it. On the certificate though, it beats almost everyone. SSL is free, issued through its Cloudflare integration on any verified domain, and it is a wildcard: www, non-www and unlimited subdomains on its managed WordPress plans.
Renewal is automatic, with one condition people forget. The _acme-challenge CNAME record has to stay in your DNS. If someone cleans up your DNS zone and deletes it, the certificate stops renewing. Kinsta emails you 30 days before expiry, so do not ignore that message.
You can also upload your own certificate, for instance an OV or EV, which Kinsta does not issue for free. Careful: there is no expiry alert for a custom certificate. Put the date in your calendar. The free certificate stays valid for 90 days and renews itself.
Price: Single 35k is $35 a month, or $350 a year billed yearly. That is a lot for a hobby blog and reasonable for a site that sells. The price also stays the same at renewal, a nice change from $1 intro offers.
- Free wildcard, unlimited subdomains
- Cloudflare integration on any verified domain
- Email alert 30 days before expiry
- ✓No certificate to issue per subdomain
- ✓Same price year after year
- ✓Custom certificates accepted
- ✗Expensive for a small site
- ✗Renewal breaks if the _acme-challenge CNAME disappears
The pick for a revenue-generating WordPress site with subdomains. For a blog, you are overpaying for a certificate Hostinger also gives away. For the wider ranking, see the best WordPress hosting.
Hostinger
Hostinger includes a free SSL certificate, installed automatically on all plans, for every domain and subdomain, free for life. Activation takes minutes and renewal is automatic and free. For a simple site, there is nothing to set up.
The wildcard answer is short: shared hosting does not offer one. To get a wildcard, you need a paid or custom certificate installed on a VPS. If you only run a handful of subdomains, that is fine, since each one gets its own free certificate.
The real question with Hostinger is price. Premium is $2.49 a month, but over 48 months paid upfront, then $10.99 a month. Unlimited goes from $3.49 to $16.99, Cloud Startup from $7.99 to $25.99.
Hostinger publishes a guide on mixed content, the classic error after moving to https: old http:// links stored in the database, blocked scripts, a broken padlock. Fix the links, then purge your CDN cache, or visitors keep seeing the warning. If you are already there and want out, read our Hostinger alternatives.
- Free SSL for life on every domain and subdomain
- Live within minutes
- Automatic renewal on all plans
- ✓Zero setup for a simple site
- ✓Very low intro price
- ✓Clear mixed content guide
- ✗The low price needs 48 months upfront
- ✗Wildcard only paid, or on a VPS
The pick if you want the cheapest four years and SSL with no setup. If you want to be free to leave after a year, look at IONOS.
Bluehost
Bluehost lists "Free SSL - Let's Encrypt" on Starter, Business and eCommerce Essentials. For most sites, that is the only certificate you need: it encrypts the connection and shows the padlock.
Bluehost also runs a full SSL shop next to it. A paid DV certificate costs $3.33 a month, then $7.49 a month. A Wildcard DV costs $19.99 a month, and an EV certificate $19.99 a month, on 12-month terms. Here is our take: a paid DV encrypts exactly like the free Let's Encrypt one. It is worth paying only for the wildcard (if you have many subdomains) or the EV (if you want your company verified).
Hosting prices are pre-tax and tied to 36 months: Starter at $3.99 a month, then $9.99. Business at $6.99, then $13.99. eCommerce Essentials at $14.99, then $21.99.
The limit: at $19.99 a month, the Bluehost wildcard costs $239.88 a year, more than a year of IONOS Plus even at its $14 renewal ($168), and that IONOS plan includes a wildcard. Do the math before you click the upgrade.
- Free Let's Encrypt on all three shared plans
- Paid DV, Wildcard DV and EV in the same account
- 12-month terms on paid certificates
- ✓Everything in one dashboard
- ✓EV available if your company needs it
- ✓Free SSL from the cheapest plan
- ✗Wildcard at $19.99/mo is expensive
- ✗Paid DV adds almost nothing over the free one
Fine for a WordPress beginner who will stay on the free certificate. If you need a wildcard, IONOS or Kinsta include one for less.
The SSL traps you only see after launch
This comes from our comparison and from customer reports on community forums and hosting reviews. Six checks to run before choosing a host, or when you migrate. For hosts ranked on every criterion, see the best web hosting, and for WordPress, the best managed WordPress hosting.
Paid DV does not encrypt better
A paid DV (domain validated) certificate encrypts exactly like a free Let's Encrypt one. Hosts still sell them: Bluehost at $3.33 a month, then $7.49. Pay only for an OV or EV certificate, which verify your company, or for a wildcard you cannot get free.
A free wildcard goes through DNS
A Let's Encrypt wildcard requires proving you control the whole domain with a DNS record. Your host has to manage your DNS, or you run a tool like Certbot with a DNS plugin. SiteGround handles that for you when the domain uses its DNS. IONOS and Kinsta include one with no extra step. Already there and leaving? See our SiteGround alternatives.
After a migration, order matters
Auto renewal often fails after a move: files left on the old host, or DNS still pointing there, block validation. A common cPanel case: a new domain is not covered and there is no AutoSSL button, because the server admin has to enable the SSL provider. Point the domain and www to the new server first, check that the Cloudflare proxy is not blocking validation, delete the old site, then issue the certificate.
Certificate lifetimes are shrinking
The maximum certificate lifetime dropped to 200 days in 2026, falls to 100 days in 2027 and 47 days in 2029. Let's Encrypt moves its default from 90 to 64 days in 2027, then 45 days in 2028. A host that does not renew on its own will soon have you stepping in every six weeks. Pick automatic renewal, even for a paid certificate.
Some hosts refuse free certificates
Some hosts have refused Let's Encrypt and pushed customers toward a paid certificate (a case reported on the Let's Encrypt forum back in 2019, with Ahead Hosting). Before you sign up, check that the free certificate is installed on your plan, not just mentioned in a footnote. All six hosts on this page include one.
Mixed content breaks the padlock
After the switch to https, old http:// links in your database load images and scripts insecurely, the browser blocks them and the padlock degrades. Run a search and replace on the database, force https in .htaccess, then purge your CDN cache.
- The certificate is included on your plan, not only the plan above
- Renewal is automatic, with no action on your side
- Every domain and subdomain gets a certificate, with no blocking quota
- Wildcard included if you have more than a few subdomains
- http to https redirect and mixed content fixed after activation
- Paid certificate bought only for OV, EV or a wildcard you need
- Year-two price checked before you pay
- Expiry date noted for any custom certificate
- DNS records used for validation left in place
Is your tool missing from this page? Email us: hello@hackceleration.com
Your questions on web hosting and SSL
Does web hosting come with a free SSL certificate?
Almost always in 2026, but not always on every plan or forever. All six hosts on this page include one on their shared or managed plans. Elsewhere, some offers only include a certificate for the first year, or reserve SSL for higher tiers. Read the plan grid line by line.
Is free SSL as good as paid SSL?
For encryption, yes: it is the same. A free Let's Encrypt certificate only validates that you control the domain (DV). A paid one can also verify your company (OV) or verify it in depth (EV), and often adds a warranty. For a blog or a business site, free is enough.
How much does an SSL certificate cost from a web host?
At Bluehost, a paid DV certificate is $3.33 a month, then $7.49 a month. A Wildcard DV and an EV certificate are $19.99 a month each, on 12-month terms. Always check the renewal price, not just the first term.
How long does a Let's Encrypt certificate last?
90 days today, renewed automatically by the hosts on this page (DreamHost renews every 60 days). Let's Encrypt moves to 64 days in 2027, then 45 days in 2028. At those lengths, manual renewal is no longer realistic: make sure your host handles it.
What is a wildcard SSL certificate and do I need one?
A wildcard covers a domain and all its subdomains with a single certificate (*.yoursite.com). You need one if you have many subdomains or create them often. Otherwise, one free certificate per subdomain does the same job. IONOS and Kinsta include one, SiteGround issues one free if it manages your DNS; DreamHost does not support them.
Can I install my own SSL certificate on my hosting?
Usually, yes. Kinsta accepts a custom certificate, with no expiry alert for it. Hostinger lets you install a paid or custom wildcard on a VPS. Bluehost sells and installs its own paid certificates. Note the expiry date of any certificate you upload yourself.
Why did my padlock disappear after switching to https?
Most of the time it is mixed content: images, scripts or stylesheets still loaded over http://. Replace the URLs in your database, force https in .htaccess, then purge your CDN cache. The padlock comes back on reload.
My SSL certificate stopped renewing. What should I do?
First check that your domain and its www point to your current host, and that the Cloudflare proxy is not blocking validation. On Kinsta, check that the _acme-challenge CNAME is still in your DNS. Then retry once: Let's Encrypt allows 50 certificates per registered domain every 7 days.
Get the next comparison in your inbox
One tool broken down every month, prices checked, limits included.