SSL Certificates on Squarespace
TL;DR:
- Squarespace provides free SSL certificates for all domains properly pointed to its sites
- SSL encrypts connections and protects data between browsers and your website
- Certificates automatically apply to Squarespace domains, connected third-party domains, subdomains, and built-in domains
- SSL settings include Secure, HSTS Secure, and Insecure options depending on your security needs
What You Need to Know About SSL Certificates
SSL certificates protect your Squarespace website by encrypting data transferred between your visitors' browsers and your website. This prevents data breaches and stops bad actors from impersonating your site. The good news is that Squarespace includes SSL certificates automatically if your domain points correctly to your site.
Setting Up SSL for Your Domain
Getting SSL working on your domain is straightforward, but there are a few things to check.
Check Your Connection
Make sure your domain points correctly to your Squarespace site. This applies whether you're using a Squarespace domain or a third-party domain. If the connection isn't right, you'll run into SSL issues.
Domain Requirements
Keep your domain name under 63 characters. Longer names can cause problems with SSL certificate generation.
How to Check SSL Status
You can verify your SSL is working in two ways:
Go to your domain's dashboard, select your domain, and check that the SSL status shows as 'Issued'.
Or simply visit your website. If the address starts with 'https://' and shows a padlock icon in the browser, your SSL is active.
Selecting SSL Settings
Head to the SSL panel in your settings to choose your security level:
- Secure – Standard SSL protection
- HSTS Secure – Enhanced security with strict transport security (recommended for most sites)
- Insecure – Allows HTTP access (not recommended)
Save your changes and allow up to 48 hours for processing.
Pixelhaze Tip: Switching to or from 'Insecure' might temporarily affect site accessibility due to HSTS policies. Plan these changes carefully.
Handling Mixed Content and SSL Errors
If you've added custom code or integrations that use HTTP instead of HTTPS, browsers will show security warnings. Update any insecure content to use HTTPS to maintain your SSL security standards.
Technical Details About Squarespace SSL
Squarespace partners with Let's Encrypt to provide Domain-Validated (DV) SSL certificates. These certificates renew automatically every 90 days and use 2048-bit SSL encryption.
Note that Squarespace doesn't support HTTP Public Key Pinning (HPKP) or third-party SSL certificates. The built-in system handles everything for you.
FAQs
What is SSL?
SSL (Secure Sockets Layer) encrypts connections between browsers and websites, protecting data privacy and security.
Can I disable SSL on Squarespace?
You shouldn't disable SSL as it protects visitor data. The 'Insecure' setting allows HTTP access but isn't recommended.
Does SSL slow down my website?
SSL might add a tiny delay during the initial connection, but it's barely noticeable and essential for security.
Do I need to set my SSL to "Secure" to protect my account details?
Account login and sensitive data are always encrypted, regardless of your SSL setting.
Jargon Buster
HSTS (HTTP Strict Transport Security) – A security policy that forces browsers to use HTTPS connections only
DNS (Domain Name System) – The system that translates domain names to IP addresses so browsers can find your website
HTTPS (Hypertext Transfer Protocol Secure) – The secure version of HTTP that protects data integrity and confidentiality
PCI Compliant – Security standards that ensure safe processing, storage, and transmission of credit card information
Wrap-up
SSL certificates on Squarespace work automatically once your domain is properly connected. The system handles renewals and technical details, so you can focus on your content. Choose the HSTS Secure setting for the best protection, and make sure any custom code uses HTTPS to avoid security warnings.
If you run into issues, double-check your domain connection first. Most SSL problems stem from incorrect domain pointing rather than the SSL system itself.
Ready to dive deeper into Squarespace? Join Pixelhaze Academy for expert guidance and advanced techniques.