WPX Business SSL Renewal: Free, Cloudflare or Custom Certificate?

Start with the simplest ownership model

For a normal WPX-hosted site where both apex and www point to WPX, the free certificate is usually the lowest-maintenance choice. WPX installs it from the control panel and says renewal is automatic. Before relying on it, confirm both hostnames resolve to the expected WPX service, the account email receives renewal notices, and the live chain has a comfortable expiry window.

WPX lists redirects, third-party CDN routing, domain forwarding, incorrect A or NS records, split destinations and its own DNSSEC compatibility warning as possible renewal blockers. Treat that list as WPX-specific troubleshooting guidance. Do not disable a security control permanently without a registrar- and host-specific diagnosis.

[Figure 1: ssl-timeline-en.svg]

Cloudflare creates two certificate boundaries

With Cloudflare in front, visitors negotiate a certificate at the Cloudflare edge, while Cloudflare negotiates another TLS connection to WPX. A green browser padlock therefore does not by itself prove the origin certificate is valid. Cloudflare Full strict requires an unexpired, trusted origin certificate that matches the hostname. WPX’s setup guide discusses a valid WPX certificate with Cloudflare, but does not guarantee every proxy or renewal configuration.

Check both layers: public edge certificate coverage and expiry, then origin coverage and expiry. Make any SSL-mode change only after the origin is valid; otherwise a stricter mode can expose an origin problem, while a weaker mode can hide it.

[Figure 2: edge-origin-en.svg]

Apex, www and aliases must match the certificate

WPX says its default free certificate covers the apex and www versions when the site is configured normally. A custom certificate can be installed for www only, which does not cover the apex. A primary domain plus an alias must be entered and covered deliberately.

Create a hostname inventory before purchase or migration: apex, www, aliases, checkout subdomains and any hostname still routed elsewhere. For each hostname, record DNS destination, edge certificate, origin certificate, owner and renewal method. A certificate file can be technically valid yet still fail because its Subject Alternative Names do not include the hostname a customer visits.

[Figure 3: hostname-coverage-en.svg]

When does a custom certificate make sense?

A custom or commercial certificate can be justified when policy requires a particular certificate authority, organization validation, a controlled key process or explicit alias coverage. WPX says it does not sell commercial certificates, but can integrate a customer-purchased certificate without an extra WPX integration fee. That does not make the certificate purchase or its future renewal free.

Custom certificates add ownership. Cloudflare likewise says uploaded custom edge certificates must be monitored, replaced and renewed by the customer. Ask who generates the key, who receives expiry alerts, who supplies the replacement chain, whether a fallback certificate exists and how an emergency rollover is tested. More expensive is not automatically more secure for a routine blog; the value comes from a requirement the managed certificate cannot satisfy.

Redirects are not a simple yes-or-no rule

WPX warns that redirects can interfere with its renewal process. Let’s Encrypt separately documents that HTTP-01 can follow a limited number of redirects to HTTP or HTTPS on standard ports. These statements are not mutually exclusive: protocol support for some redirects does not guarantee that a host’s automation, proxy rules or destination topology exposes the validation token correctly.

For renewal failure, capture the exact hostname, DNS answer, redirect chain, CDN proxy state and renewal notice before changing rules. Make a temporary, documented fix with WPX support, verify the new certificate, then restore only the rules that are still required.

Certificate issuance and WordPress HTTPS are separate

WPX’s installation guide treats mixed-content cleanup as a later step. WordPress also documents site URL, reverse-proxy and asset-loading considerations. After certificate installation, test the canonical page, checkout, login, images, scripts and redirects in both languages or site variants. A clean certificate cannot repair hard-coded HTTP assets, and a plugin cannot extend certificate hostname coverage.

[Figure 4: responsibility-check-en.svg]

A practical renewal acceptance test

At least 30 days before expected expiry, record the certificate issuer, covered hostnames and expiry at both edge and origin. Confirm the WPX account email, test apex and www, inspect aliases, and review recent DNS or CDN changes. After WPX’s expected renewal window, verify that the served certificate actually changed; do not rely only on a dashboard label.

Choose the free WPX certificate when your topology is simple and you want WPX to own the routine lifecycle. Choose a custom certificate only for a documented coverage, identity or policy need and assign a named renewal owner. For Cloudflare, keep edge and origin evidence separate. WPX Business can be a good fit, but the buyer should value an observable renewal process rather than assume “automatic” means unbreakable.

This article states no coupon, fixed price or renewal guarantee. Live WPX checkout controls billing, and the commercial button maps only to the approved WPX Business offer.

[Check the current WPX Business offer](/go/wpx-managed-wordpress-business-official-usd)

Sources: WPX automatic renewal https://wpx.net/kb/automatic-ssl-certificate-renewals/ WPX custom certificate https://wpx.net/kb/how-can-i-install-a-custom-ssl-certificate/ Let’s Encrypt challenge types https://letsencrypt.org/docs/challenge-types/ Cloudflare Full strict https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/ WordPress HTTPS https://developer.wordpress.org/advanced-administration/security/https/