How to Fix Your SSL Certificate on Wix

Your Wix site gets a free SSL certificate. It is provisioned automatically and renewed automatically. There is no button to press, no yearly fee, and nothing to remember.

That means if an SSL check on your Wix site fails, you are almost certainly looking at one of three things: the certificate has not finished provisioning yet, your pages are loading something over plain HTTP, or you are trying to do something Wix does not allow.

Certificate provisioning on Wix can take up to 48 hours. During that window your site can show a certificate warning, and that is expected rather than broken.

This is the single most common "my Wix SSL is broken" situation, and the fix is patience. Do not start changing DNS records to hurry it along, because that usually restarts the clock.

If you are past 48 hours and still seeing warnings, then something is genuinely wrong and it is worth contacting Wix.

Wix does not support third-party certificates. If you already bought one, or your organisation requires a specific issuer, that is not going to work here. The free automatic certificate is the only option.

Note that Wix's pages on third-party SSL are feature-request pages actively collecting votes, so this is a "currently" rather than a permanent answer.

One related point: we are not going to name Wix's certificate authority, because we could not confirm it. If you are considering CAA records, which restrict which authorities may issue for your domain, do not guess. A wrong CAA record blocks renewal, and on Wix you have no manual override.

Here is the situation that confuses people most. Your certificate is valid, HTTPS works, and the browser still shows the padlock as broken or missing.

That is mixed content. The page itself loaded over HTTPS, but something on it, an image, a font, an embedded widget, a script, was requested over plain http://. Browsers flag the whole page for it, and they will often block the resource outright, which is why an embed sometimes just vanishes.

What to look for:

The fix itself is simple. Find every http:// reference and change it to https://, or re-add the resource so it comes from a source that supports HTTPS.

Your browser tells you exactly where they are. Open the page, open developer tools, and look at the console. Mixed content warnings name the offending URL.

One thing to avoid: protocol-relative URLs, the ones written as //example.com with no http or https. They were a legitimate trick years ago. They are no longer recommended. Just write https:// and be explicit.

If you are also working through the rest of your security checks, do them in this order. It is not a style preference, it is how you avoid locking visitors out of your own site.

On Wix, this step is out of your hands and that is mostly good news. At the time of writing Wix sites already respond with HSTS, and you could not change it anyway. See our security headers on Wix page for the full picture, or the HSTS glossary entry for what it does.

While we are here: do not go looking for HSTS preloading. Preload lists require a year-long max-age, includeSubDomains, a valid certificate, an HTTP to HTTPS redirect, and every subdomain on HTTPS. Inclusion cannot easily be undone, and removal takes months to reach people as a browser update. It is not a casual toggle, and on Wix it is not yours to toggle regardless.