SSL, CDN and speed

Yes. Every hosting package includes a free SSL certificate for the domain and all its subdomains, the mail names imap, smtp and mail included. It renews by itself every 90 days. It needs your domain to use our nameservers, wherever the domain is registered, .lk and .com.lk included. It is usually switched on for new hosting automatically; otherwise use "Activate Free SSL" on the control panel's SSL/TLS page. It takes about 30 minutes; until then the browser can show "not secure" or a certificate for another name.

• The nameservers are not ours yet, or the change is still spreading (up to 48 hours).
• DNSSEC is switched on at the registrar (WHOIS shows "DNSSEC: signed"); switch it off there.
• An _acme-challenge CNAME record from an old host is still in the DNS; remove it in Manage DNS.
• Our nameservers were entered as NS records at another DNS provider rather than as the domain's nameservers at the registrar.

If none of these apply, write to us.

Yes, with a certificate bought elsewhere (SSL/TLS, Install External SSL Certificate: the certificate, private key and CA bundle from the provider), or with Cloudflare in front of the site, a Cloudflare Origin Certificate installed the same way and Cloudflare set to Full (strict). We can do it for you; write to us.

Control panel, SSL/TLS, Enable Force HTTPS. Switch it on only once the certificate works.

The page loads images, scripts or styles over http:// ("mixed content"). The browser console (right-click, Inspect, Console) lists them, and whynopadlock.com checks a page. Those links have to become https://; for WordPress see mixed content in WordPress.

The temporary URL is meant for http://. Something forces https: switch off Force HTTPS, set the WordPress site and home address to http://, disable plugins such as Really Simple SSL, remove https redirects from .htaccess, and try a private browser window.

The cause is on your computer, not the site: antivirus that inspects HTTPS (Bitdefender, ESET and others), a VPN or proxy, changed SSL settings (Refresh Firefox helps), DNS over HTTPS, or a damaged Firefox profile.

The free CDN keeps copies of your images, CSS, JavaScript, fonts and PDFs at locations near your visitors, so pages load faster. It is in the control panel under Edge Caching, where you can also set how long files stay cached.

Clear the cache: Edge Caching, Purge Everything (or purge in your WordPress caching settings), then check in a private browser window.

No. W3 Total Cache, WP Super Cache, WP Rocket, Hummingbird and similar plugins are not needed and can conflict with the CDN; we recommend removing them. Image optimisation and lazy-loading plugins are not needed either when Web Optimisation is on.

In the browser's developer tools, Network tab, the response header x-cdn-cache-status: HIT means from the cache, MISS a first load or not cacheable, BYPASS deliberately not cached (logged in to WordPress, cart, checkout, account pages). Pages keep missing when they set cookies, a caching plugin interferes, or .htaccess sends Cache-Control: no-store.

In that folder's .htaccess, then purge:

Header set Cache-Control "no-store"

For one file type put it in a FilesMatch block, for one file in a Files block.

Switch on Web Optimisation in the control panel: image resizing and WebP, lazy loading, smaller and combined CSS and JavaScript. "One Click Optimisation" sets safe defaults. If the site looks wrong after switching a filter on, switch that filter off again. Fewer plugins and a current PHP version help too.

Google PageSpeed scores lower on mobile because it tests a slow phone on a slow network. Unused JavaScript is the usual cause, and only changing the site's code removes it.

Control panel, Security Headers (in the CDN section): X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security (HSTS) and Content-Security-Policy, without editing files.

The control panel's Statistics count every request through the CDN, bots included; Google Analytics does not count bots.