SSL and backups get bundled in marketing as if they were the same product feature. They are not. SSL (TLS) encrypts traffic between browsers and your origin. Backups let you recover files and database rows after human or machine disaster. WPHost includes certificate management as part of hosting. WPHost does not sell a scheduled full-site WordPress backup product. Deploy history restores files. Your posts live in MySQL — plan accordingly.
This honesty is the point of the article.
SSL on WPHost: what happens when
Preview HTTPS. New sites get a working HTTPS URL immediately. Use it for the installer and for QA. You do not wait on DNS to encrypt the preview hostname.
Custom domain certificates. Attach the domain in site settings, create the DNS records shown, wait for verification, and the certificate issues for that name. Until DNS is correct, the custom name cannot magically grow a cert.
WordPress must agree. After the custom cert works, set WordPress Address (URL) and Site Address (URL) to https://your-domain in Settings → General. If the database still says http://, you invite redirect loops and mixed content. Recovery patterns: custom domain guide.
TLS renewals are platform-managed. You should still notice if a domain lapses at the registrar — certificates cannot save an expired name.
What SSL does not do
- It does not update plugins.
- It does not stop stolen passwords (use 2FA — security).
- It does not back up MySQL.
- It does not replace a CDN or WAF you did not configure (we have no built-in CDN product).
Padlock icons are hygiene, not a business continuity plan.
The backup gap — read carefully
WordPress state splits across:
| Piece | Contents | Restored by deploy history? |
|---|---|---|
| Core / theme / plugin files | PHP, CSS, JS | Yes, prior file releases |
wp-content/uploads | Media | Only if those files were in the deployed tree you roll back to |
| MySQL | Posts, pages, users, options, Woo orders | No |
Rolling back a bad theme deploy is why file history exists. Recovering yesterday’s blog posts after a plugin deleted them requires a database backup you took earlier.
What to use instead (practical)
Install a backup plugin such as UpdraftPlus (or BackWPup, BlogVault, etc.). Configure schedules for:
- Database (daily is common for active sites)
- Plugins/themes (less frequent if you rarely change them)
- Uploads (size-dependent)
Send copies to storage you control: S3, B2, Drive, Dropbox, another provider. A backup that only lives on the same origin is a single failure domain.
Test restore on staging (Pro+) or a disposable site slot. Untested backups fail at the worst time.
Migration dumps are cousins of backups — migrate. Keep one clean SQL export before major updates.
Staging is not a backup
Staging on Pro+ is a persistent copy for experiments. It can drift. It can be overwritten by your own tests. It is not an append-only backup history. Do not delete production backups because “we have staging.”
Likewise, git is not a database backup. GitHub connections are per-person and file-oriented — useful, not sufficient.
Recommended backup policy by site type
Personal blog. Weekly full + daily DB if you post often. Starter $9 may be enough; still use a plugin.
SMB brochure. Daily DB, weekly files. Before contractor design days, take an extra manual backup — small business.
WooCommerce. More frequent DB backups (orders change). Know that we offer no checkout SLA — backups are how *you* survive plugin incidents — Woo.
Membership / courses. DB holds access entitlements. Backup before membership plugin updates — membership, courses.
SSL + backups during domain cutover
When transferring hosts, keep old backups until the new origin proves itself. New certs appear after DNS; old host may still serve some clients mid-TTL — transfer. Do not cancel the old host the same hour you flip A records.
What your plan price buys (and does not)
Starter $9 / Pro $30 / Scale $65 / Business $130 include TLS workflows and file deploy history within site/storage caps (1×2 GB, 3×10 GB, 10×30 GB, 30×100 GB + teams on Business). They do not include email, cPanel, built-in CDN, nonprofit coupons, one-click installers, or auto plugin updates. Trial ~1 day. Full table: pricing.
Managed framing: we manage certificates; you manage application backup discipline — what is managed.
A minimal setup afternoon
- Finish WordPress on preview HTTPS — first host.
- Install backup plugin; run first full backup off-site.
- Attach domain; wait for cert; fix siteurl/home to https.
- Confirm padlock on a logged-out page and in wp-admin.
- On Pro+, create staging; practice one restore drill this month.
- Calendar reminder: monthly restore spot-check, weekly update+backup habit.
Certificates and WordPress redirects — paired failure modes
People debug TLS in isolation and WordPress redirects in isolation. Often both are wrong together: certificate not yet issued *and* siteurl still http. Sequence fixes: DNS → cert valid in browser → then siteurl/home https → then purge caches. Jumping to search-replace while DNS still points at the old host wastes an evening — custom domain, transfer.
Retention and GDPR-ish practicality
Keep backup retention long enough to survive a late-discovered defacement (weeks, not hours) but not infinite unmanaged PII sprawl on every laptop. Prefer encrypted cloud destinations your org controls. Hosting plans do not replace your data policy.
Who holds the backup keys
If only your freelancer’s personal Dropbox holds backups, you do not have an institutional backup. Prefer org-owned storage. Offboarding should not orphan restores — freelancers.
Label backup jobs with the site domain and date format you can sort under stress.
TLS is solved early; backups are not
HTTPS on the WPHost preview works when the site is published. Custom-domain certificates issue after DNS verifies — not before. Mixed content afterward is usually wrong siteurl/home or hardcoded http:// in the database — fix URLs rather than installing three SSL plugins.
Backups: deploy history restores files from deploys. Posts, orders, and users live in MySQL. Install UpdraftPlus (or similar), schedule off-site copies, and test a restore on staging. That distinction is the whole article most hosts blur.
A restore drill worth an hour
- Take a fresh backup.
- Make a harmless visible content change.
- Restore on staging (Pro+) from the backup.
- Confirm the change reverts.
- Document which credentials the backup destination used.
No email hosting means backup failure notices should go through an ESP you control. Plans $9 / $30 / $65 / $130 do not change TLS physics; Pro+ mainly adds staging space to practice restores safely. We still do not auto-update backup plugins for you.
FAQ
Is SSL free on WPHost?
Certificate issuance for preview and attached custom domains is part of the hosting workflow — not a separate upsell in this product story. The domain name itself is purchased elsewhere.
Can I download a full snapshot from the host UI as my only backup?
Do not rely on that as WordPress-aware disaster recovery. Use a plugin or SQL dumps plus file copies to external storage.
Does deploy rollback undelete a post?
No. Posts are database rows. Rollback restores files from a prior release.
Why did HTTPS show a warning on my custom domain?
DNS not pointed yet, mixed old records, or certificate still issuing. Wait and verify records. Meanwhile preview HTTPS should work.
Do I need backups if I never change anything?
Yes. Plugins decay; hosts are not immortal; attackers exist. Infrequent change means infrequent backup *frequency*, not zero backups.