Enable automatic renewal and expiry alerts so your WordPress SSL certificate never lapses. An SSL/TLS certificate is a server file that enables HTTPS, so replace it automatically before its Not After date. Manual tracking fails when staff change or mail goes unread. Automation plus a backup alert keeps coverage continuous through renewals.
Table of Contents
- What visitors see when coverage lapses
- How long does your certificate last?
- How do you automate renewal?
- What should you check in WordPress after renewal?
What visitors see when coverage lapses
An expired certificate has passed its Not After date. Browsers refuse it and show a warning instead of your site.
Google Chrome Help links expired certificates to errors such as NET::ERR_CERT_DATE_INVALID (Google's Chrome certificate error help). Chrome also shows Your connection is not private, which deters many visitors from proceeding.
How long does your certificate last?
Let's Encrypt notes in Let's Encrypt's certificate lifetime documentation that default certificates are valid for 90 days since its 2015 launch. Shorter lifetimes limit damage from mis-issuance and key compromise and push sites toward automation. Let's Encrypt recommends automatic renewal when one-third of lifetime remains. For 90-day certificates, that means 30 days before expiry, plus checking ACME Renewal Information at least twice daily.
The CA/B Forum says Ballot SC-081v3 was approved by 25 issuers plus Apple, Google, Microsoft and Mozilla. It cuts maximum public TLS validity from 398 days to 200 days in 2026, 100 in 2027, and 47 by 2029. Let's Encrypt announced 64-day default certificates starting Feb. 10, 2027, with the last 90-day certificate expiring May 11, 2027. Let's Encrypt cuts authorization reuse from 30 to 10 days and tells operators to renew at about two-thirds of lifetime plus add failure alerting.
How do you automate renewal?
EFF's Certbot user guide states that the renew action only renews certificates expiring in less than 30 days (EFF's Certbot user guide). It is meant to run unattended via systemd timer or cron. The same guide notes that certbot renew –dry-run tests renewal without replacing certificates.
Use that test before you depend on the schedule. Automation can still fail when validation, DNS, or server access breaks. A separate alert gives you time to fix the issue while the current certificate remains valid.
- Use a certificate client that supports automatic renewal
- Schedule an unattended renewal check
- Test with a dry run before expiry
- Add failure alerting and an independent expiry monitor
What should you check in WordPress after renewal?
The WordPress Developer Handbook states WordPress is fully compatible with HTTPS when a certificate is installed (WordPress HTTPS documentation). It strongly recommends HTTPS to protect logins and site visitors. The same Handbook says owners should define FORCE_SSL_ADMIN as true in wp-config.php only after server SSL and secure virtual host work.
Browsers label non-HTTPS sites not secure. After each renewal, load wp-admin over HTTPS and confirm no warning appears. Keep the secure virtual host active so admin sessions stay encrypted.
