TOOLNAVIA / BUYING GUIDE
Verpex Bronze HTTPS: Free AutoSSL and Cloudflare Redirect-Loop Checks
The short answer
Verpex Bronze includes free AutoSSL, so a redirect loop is not, by itself, a reason to buy another certificate or a larger server. The useful question is whether the certificate, Cloudflare connection and redirect rules agree. This documentation-based guide separates those decisions; we did not test a paid Bronze account.
At a glance
- Best for
- A modest single website that fits Bronze resources and whose owner can verify the certificate and HTTPS route or ask support to do so.
- Price model
- Free basic AutoSSL included; public Bronze renewal reference $6/mo. Final term, tax and cart control.
- Check first
- Buyers expecting a free certificate to fix application configuration, remove malware, prove compliance, or replace a verified origin TLS connection.
What the included SSL actually saves
Verpex advertises automatic certificate installation and renewal for hosted domains. Its installation guide also places certificate setup before forcing HTTPS. These reduce certificate-management work, but do not automatically correct application URLs or conflicting redirects.
There are four useful controls to distinguish:
| Control | Benefit | Boundary | |---|---|---| | Included AutoSSL | Avoids a separate basic-certificate purchase. | Check that issuance actually succeeded. | | Automatic renewal | Reduces manual renewal work. | Still verify the live certificate after changes. | | cPanel Force HTTPS | Sends visitors to the secure URL. | Requires a valid certificate and compatible application rules. | | Optional Cloudflare Full (strict) | Encrypts the origin connection and validates its certificate. | A Cloudflare setting, not an extra Bronze entitlement. |
Validate the origin before changing redirects
With Cloudflare proxying enabled, the browser-to-Cloudflare connection and Cloudflare-to-Verpex connection are separate. Full (strict) requires HTTPS on the origin's port 443 and an unexpired certificate from a publicly trusted authority or Cloudflare Origin CA, with a matching hostname. A failed check can produce error 526.
Our suggested preflight is to record the intended hostname, certificate status, current encryption mode and existing redirect rules. Have Verpex confirm the origin configuration when you cannot inspect it.
Do not paste the example hostnames or rewrite rules from an old tutorial into production. The Verpex article explains the installation sequence, while current cPanel documentation identifies **Domains → Force HTTPS Redirect** as the appropriate control for this particular task.
Diagnose the symptom, not the marketing label
| Symptom | First distinction to check | |---|---| | Repeated redirects | Flexible sends HTTP to the origin; an origin HTTPS redirect can create a loop. Contradictory URL rules can also loop. | | Cloudflare 526 | Investigate origin-certificate validity, hostname and trust requirements. | | HTTPS page with broken or insecure assets | Investigate HTTP resource URLs; this is mixed content, not proof of a missing paid certificate. |
Once origin TLS is valid, prefer a verified Full (strict) configuration rather than leaving the origin hop unencrypted. Changing mode alone will not fix an application that redirects HTTPS back to HTTP.
Cloudflare Automatic HTTPS Rewrites can help with eligible resources, but cannot convert an asset whose server does not support HTTPS, and does not resolve every JavaScript/CSS-loaded URL. Correct the underlying asset reference where needed.
Make one controlled change, then test the route
Our recommended workflow is to preserve the current configuration, list redirect owners—Cloudflare, cPanel, application and any custom rules—and select one consistent secure destination. Align destinations across layers. cPanel warns that CMS redirects can conflict with its HTTPS toggle.
Change one relevant setting at a time after confirming the certificate. Avoid a blanket deletion of unrelated redirects. cPanel's general Redirects interface controls destination URLs and may write rules into .htaccess; application rules can affect how they behave.
Use this proposed acceptance sheet, not just a successful homepage load:
| Test | Record | |---|---| | HTTP and HTTPS entry URLs | Final secure URL and any repeating Location headers. | | Apex and www, where configured | The intended destination without hostname ping-pong. | | A deep page, login and form | Page works and the intended action completes. | | Images, scripts and styles | No remaining relevant mixed-content failures. |
These are suggested checks, not results we measured. Restore the last known-good configuration if a change breaks service; ask support to repair invalid origin TLS rather than treating disabled validation as the permanent fix.
Price the hosting, not a second SSL purchase
Checked November 2, 2026, Bronze's public table lists one website, 30GB NVMe, 1GB RAM, one vCPU and a **$6/month renewal reference**. Twelve months at that displayed rate is $72 by arithmetic, not an observed annual invoice. The basic SSL allowance is already included.
Confirm the first-term total, billing period, actual renewal, tax and optional extras in the cart. No authenticated checkout quote was obtained. More server resources are a separate workload decision; see the [Bronze resource guide](/en/hosting/verpex-bronze-resource-limits).
When Bronze is enough—and when to get help
Shortlist Bronze for a modest single site when the resource limits fit and you can verify the HTTPS path. For an existing account, investigate the specific certificate or configuration fault before upgrading. Ask support for the affected hostname, origin-certificate status and redirect diagnosis when the cause remains unclear.
For separate malware and geography questions, see the [security](/en/hosting/verpex-bronze-malware-scan-vs-cleanup-responsibility) and [location](/en/hosting/verpex-bronze-server-location-cloudflare-latency) guides.
**Affiliate disclosure:** Toolnavia may earn a commission from an eligible purchase through the Verpex link below. A referral link does not guarantee issuance time, error-free configuration or search rankings.