Secure a Nigerian blog with a free SSL certificate
Learning how to set up a free SSL certificate for your Nigerian blog using Let’s Encrypt gives readers an encrypted connection between their browsers and your server. The certificate works globally, so a website hosted in Lagos, Abuja, or Port Harcourt can serve visitors in Sydney, Melbourne, Brisbane, and other Australian cities securely.
HTTPS matters because many Australians browse blogs and shops on mobile devices during commutes, lunch breaks, and café visits. They are accustomed to checking the address bar for https:// before entering passwords or payment details. Search engines also treat HTTPS as a trust signal, although a valid certificate alone does not guarantee high rankings or a secure WordPress installation.
You can complete the setup without buying a certificate. You will need control of your blog’s domain and server, though. Managed WordPress hosts such as SiteGround, Kinsta, or Cloudways may provide an automatic Let’s Encrypt option, while a VPS gives you direct control through Certbot.
Check the domain and hosting
Confirm that your domain’s DNS records point to the server hosting the blog. An A record should contain the server’s IPv4 address, while an AAAA record should be present only when the server has a correctly configured IPv6 address. An incorrect IPv6 record can cause certificate issuance to fail because Let’s Encrypt cannot reach the website over that connection.
Decide whether both example.com and www.example.com will be used. Include both names in the certificate if visitors can reach either version. Remove obsolete DNS records, make sure ports 80 and 443 are allowed through the server firewall and cloud security group, and back up the Nginx, Apache, and WordPress configuration files before making changes.
Install Certbot on an Ubuntu server
For an Ubuntu or Debian server with Nginx, connect through SSH and install Certbot with its Nginx plugin. Run the commands as a user with sudo privileges:
sudo apt update
sudo apt install certbot python3-certbot-nginx
Certbot requests certificates, places them in the correct server directory, and can modify the virtual host configuration. If the server uses Apache, install the relevant packages instead:
sudo apt install certbot python3-certbot-apache
Do not install server packages on shared hosting where you lack root access. Check the hosting dashboard for “Free SSL,” “Let’s Encrypt,” or a similar security feature. These tools automate issuance and renewal, although you may still need to verify the domain and force HTTPS in WordPress.
Request the certificate with Certbot
Certbot normally detects the existing web server configuration and asks which domain names should receive the certificate. Replace the example domains with your own, including the www version only if it resolves to the same blog:
sudo certbot --nginx \
-d example.com \
-d www.example.com \
--email admin@example.com \
--agree-tos \
--redirect
Enter a monitored email address so you receive expiry and account notices. The --redirect option sends ordinary HTTP requests to HTTPS. Choose a single preferred domain if the tool asks you to make www.example.com or example.com the main address, since consistent addresses avoid duplicate-content issues.
Apache installations use a similar command:
sudo certbot --apache \
-d example.com \
-d www.example.com \
--redirect
If you use Cloudflare, temporarily set the relevant DNS records to “DNS only” if certificate requests fail through the orange-cloud proxy. Once issuance succeeds, the proxy can be restored. If WordPress sits behind a custom reverse proxy, you may need the webroot method and the exact directory containing the site files rather than an automatic web-server plugin.
Compare certificate choices before proceeding
The certificate’s domain suffix does not affect trust. A Nigerian .com.ng domain, a global .com, and an Australian .com.au domain can receive the same public certificate. If the business genuinely meets the Australian domain eligibility requirements, .com.au or .au may suit its local market, but the certificate itself provides no ranking advantage.
| Certificate option | Cost | Browser trust | Renewal | Suitable use |
|---|---|---|---|---|
| Let’s Encrypt with Certbot | Free | Trusted by modern browsers | Short-lived and automated | Public blogs and small businesses |
| Host-managed free certificate | Usually free | Trusted when properly issued | Managed by the hosting provider | Managed WordPress hosting |
| Paid commercial certificate | Paid | Trusted | Provider-dependent | Complex business requirements |
| Self-signed certificate | Free | Warning outside trusted setups | Manual | Local testing only |
For a Nigerian blog serving Australian visitors, Let’s Encrypt offers the best balance of cost and control. A paid certificate adds expense without improving basic browser trust. The automation is essential because Let’s Encrypt certificates remain valid for about 90 days and must be replaced before expiration.
Confirm HTTPS across the blog
Visit https://example.com after Certbot finishes, then test the www address, individual posts, images, contact forms, and any shopping pages. Each address should load without a certificate warning. You can also inspect the redirect from a terminal:
curl -I http://example.com
curl -I https://example.com
The first request should return a permanent or temporary redirect to the HTTPS URL. The second should return a successful response using your certificate. An external checker such as SSL Labs can inspect the certificate chain and server configuration, while your browser provides the clearest indication of the visitor experience.
After HTTPS works reliably, open WordPress Settings and change both the WordPress address and site address from http:// to https://. Save each setting carefully and clear the WordPress, browser, and any caching plugin. Old posts may contain insecure images, scripts, embeds, or links to other HTTP resources, so update those assets where possible. Broken external resources can produce mixed-content warnings or prevent parts of a page from loading.
Automate renewal and protect keys
The Ubuntu Certbot package normally installs a systemd timer that checks for renewal twice daily. Confirm that the timer is active and conduct a practice renewal:
sudo systemctl status certbot.timer
sudo certbot renew --dry-run
The dry run contacts the certificate authority and exercises the renewal process without replacing the live certificate. Check the listed certificates with sudo certbot certificates. Keep the email address active, monitor the site’s expiry date, and investigate failed renewal emails promptly. Avoid repeated automated attempts against the same domain because Let’s Encrypt applies failure-rate limits to protect its services.
The live certificate files are normally located under /etc/letsencrypt/live/example.com/. Web servers need both the fullchain.pem certificate and privkey.pem private key, but the private key must remain secret and readable only by the server account. Back up configuration files securely if your recovery plan requires them, and never paste the private key into WordPress, email, a public repository, or a support chat.
Fix the warnings Nigerian bloggers hit
A “Name Mismatch” warning usually means the certificate lacks the exact hostname being opened. Verify your DNS, include both the root and www domains, and restart the web server after replacing a certificate. An “Invalid certificate” warning can result from an expired certificate, an incomplete intermediate certificate chain, incorrect system time, or DNS pointing to another server.
A timeout during issuance usually means Let’s Encrypt cannot reach port 80. Check DNS propagation, upstream firewalls, hosting security groups, and any redirect loop. When using the webroot method, make sure the challenge directory is publicly accessible and that the web server is not rejecting the request. After changes, run another dry renewal rather than repeatedly submitting new live requests.
A secure padlock also depends on operations outside encryption. Keep WordPress, plugins, themes, and PHP updated; use unique administrator credentials and multi-factor authentication; restrict wp-admin access where practical; and maintain tested backups. For an Australian audience, review the Privacy Act 1988 and Australian Privacy Principles when contact forms or mailing lists collect covered personal information. HTTPS protects data in transit, but it does not replace appropriate consent, privacy notices, retention controls, or secure data handling.
Start by confirming your DNS and obtaining a backup. Install Certbot, issue the certificate for every hostname readers can use, and complete the renewal test before announcing the secure URL. Once the HTTPS address is live, make it the permanent home of the Nigerian blog and give every Australian visitor a trustworthy first connection.