SSL is not a premium upsell anymore; it is table stakes. Cheap WordPress hosting with SSL should mean HTTPS on a current PHP host without turning certificates into a $30 add-on. WPHost includes HTTPS on preview URLs and issues custom-domain certificates after DNS verifies — on plans priced $9 / $30 / $65 / $130, runtime PHP 8.4.

WordPress is PHP + MySQL. No one-click installer. No auto plugin updates. No email. No built-in CDN. Deploy history ≠ database backup. WooCommerce can run without a PCI SLA.

Cheap plans that still ship TLS

Starter $9 (1 site, 2 GB), Pro $30 (3 sites, 10 GB, staging/cron), Scale $65, Business $130. Certificate automation is part of the host, not a SKU. Cost primers: how much does WordPress hosting cost. Certificate + ops siblings: WordPress hosting with SSL certificate. Store TLS notes: WooCommerce hosting with SSL.

Free hosts sometimes offer HTTPS on *their* subdomain only. That is not the same as TLS on the domain you own.

Free hosting’s SSL illusion

A free https://you.freehost.tld padlock does not protect a brand on you.com if you never control DNS. Cheap paid hosting with a real domain is the adult version of “we have SSL.”

Worked example: restaurant PDF menu plus HTML hours

Restaurant site: hours in HTML, PDF menu, phone number, map embed. Customers notice browser warnings immediately on mobile.

Path: Starter ($9). Upload WordPress, MySQL, installer on HTTPS preview first. Build pages using HTTPS-compatible embeds. Upload a compressed PDF. When ready, point DNS to WPHost, wait for the custom-domain certificate, confirm the padlock on https://restaurant.example.

If migrating, bring a database dump — file-only copies lose the hours page content even if TLS is perfect.

Skipping the database dump during an SSL-motivated move

Many restaurants leave an old host because browsers warn or the old panel’s certificate tooling broke. They copy theme files over FTP to “the host with SSL,” skip MySQL, and celebrate the padlock on an empty shell. Posts, menus, and widget text live in the database. Deploy history on the new side cannot invent it.

Migrate with a dump, verify content on HTTPS preview, then DNS. Fix any http:// media URLs so mixed content does not break the padlock you just earned. We do not run a CDN product; if you use one, terminate TLS sanely end to end. Email remains separate — do not sweep MX into the web host while fixing certificates.

SSL hygiene that stays cheap

  • Finish the WordPress installer on HTTPS; avoid training siteurl on HTTP.
  • After domain attach, confirm wp-admin also loads on HTTPS.
  • Do not install random “force SSL” plugins that conflict with host redirects unless you understand them.
  • Keep backups: a certificate does not restore hacked content.
  • Update plugins yourself; we do not auto-update.

What cheap SSL hosting is not

Not a free forever tier. Not Softaculous. Not mailbox hosting. Not unlimited disk. Not PCI-as-a-service for Woo.

FAQ

Is SSL really free on Starter?

Certificate issuance for your attached domain is part of the hosting, not a separate WPHost line item. Domain registration is still paid at a registrar.

Do I need a CDN to have HTTPS?

No. HTTPS terminates at the host. A CDN is optional and not bundled.

Will you auto-update plugins that touch HTTPS redirects?

No auto plugin updates. Change redirect plugins carefully after backups.

Can deploy history fix a bad search-replace of URLs?

Only if the damage was in files you redeployed. Database URL mistakes need database restores.