Free HTTPS for your forum with Let's Encrypt

Every forum login sends a password. Without HTTPS, that password can be read by anyone on the same network. HTTPS also stops browsers from labeling your site "Not secure." Let's Encrypt is a free, automated certificate authority, and most hosts can set it up in a few clicks.

Key takeaways

Let's Encrypt certificates are free and currently valid for 90 days by default.
Lifetimes are shrinking: 64 days for the default profile from Feb. 10, 2027, then 45 days from Feb. 16, 2028.
Use automated renewal (your host's AutoSSL or Certbot) so nothing depends on you remembering.

Getting a certificate

Let's Encrypt: Getting Started explains that you prove control of your domain using software that speaks the ACME protocol. There are two common routes:

Shared hosting: many control panels (cPanel's AutoSSL, for example) issue and renew certificates automatically. Check your host's SSL/TLS section first.
Your own server (VPS): Certbot (EFF), from the EFF, can obtain a certificate and set up automatic renewal for common web servers like Apache and Nginx.

Why automation matters now

The Let's Encrypt FAQ says default certificates are valid for 90 days. In its post Let's Encrypt: Decreasing Certificate Lifetimes to 45 Days (Dec. 2, 2025), Let's Encrypt says lifetimes will be cut in half to 45 days by 2028, as required by the CA/Browser Forum's Baseline Requirements. The timeline:

May 13, 2026: an opt-in "tlsserver" profile began issuing 45-day certificates.
Feb. 10, 2027: the default profile switches to 64-day certificates with a 10-day authorization reuse period.
Feb. 16, 2028: the default moves to 45-day certificates with a 7-hour authorization reuse period.

If you renew automatically, these changes should be invisible. If you've ever renewed by hand, now is the time to switch to automated renewal.

After switching to HTTPS

Redirect HTTP to HTTPS site-wide (a 301 redirect).
Update the forum's board URL setting (phpBB server settings, XenForo board URL, etc.) so generated links use https://.
Fix mixed content: old embedded images and scripts loaded over http://.
Update your sitemap and Search Console property (see forum SEO basics).
Secure admin accounts with strong passwords and two-factor authentication (see forum admin security).
Set up expiry monitoring so you get an alert if renewal fails.

HTTPS is also part of a fast, healthy forum; see forum speed optimization and backing up your forum.

Published October 28, 2026. We do not use affiliate links on this page; see our Affiliate Disclosure.