A certificate helps a browser establish an authenticated, encrypted HTTPS connection to a website. “SSL certificate” remains a common product name, but modern HTTPS uses TLS rather than the older SSL protocols.
Understand what the certificate proves
A trusted certificate connects a hostname with a public key under the certificate authority’s validation rules. Domain validation checks control of the domain; it does not certify that the business is honest, that its products are good or that its application has no security flaws. Let’s Encrypt explains its domain-validation process.
Encryption protects information while it travels between the browser and the TLS endpoint. It does not protect data that an already compromised application exposes, nor does it replace secure account access or software updates.
Check the names visitors actually use
- Confirm the certificate covers the website hostname and any intended aliases.
- Check subdomains separately. A certificate for the main domain does not automatically cover every other hostname.
- Confirm the certificate chain is trusted and the certificate is within its validity period.
- Check the connection through the public hostname, not just a server control-panel screen.
If a CDN or reverse proxy sits in front of the site, there may be a separate encrypted connection to the origin. Both sides need an appropriate configuration; a valid browser-facing certificate alone does not describe the origin connection.
Finish the HTTPS setup
Update the application URLs and redirect ordinary HTTP visits to the corresponding HTTPS path. Look for mixed-content requests, where a secure page still tries to load insecure resources. Test images, scripts, forms and any third-party integrations.
Do not rely on a particular padlock or green address-bar design: browser interfaces change. Inspect the browser’s connection information and investigate certificate warnings instead of teaching visitors to bypass them.
Keep renewal observable
Know who operates certificate renewal and where failures are reported. Check that the renewed certificate is actually served to visitors. If renewal uses a domain-validation challenge, preserve the access it needs when changing DNS or web-server rules.
Combine transport security with the WordPress maintenance checklist. HTTPS is one part of protecting a website, not a substitute for the rest.