WordPress.com enables HTTPS with Let's Encrypt for new hosted sites with custom domains, will soon expand support to 1M+ sites currently using custom domains
HTTPS Everywhere: Encryption for All WordPress.com Sites — Today we are excited to announce free HTTPS for all custom domains hosted on WordPress.com.
Context & Ripple Effects
This lands two months after WordPress.com's automatic AMP rollout, another case of Automattic turning a platform-level upgrade on by default rather than leaving it to site owners. With WordPress already powering a quarter of the web per the late-2015 share report, flipping HTTPS on for custom domains moves the encrypted-web needle at population scale.
The mechanism matters as much as the announcement: certificates come from Let's Encrypt, meaning a hosted platform is now provisioning PKI for over a million custom domains — work that previously required each owner to buy and install a certificate.
First-order effects
- Over 1 million WordPress.com owners with custom domains get HTTPS without buying, installing, or renewing certificates, removing the cost-and-complexity barrier that kept most custom-domain sites on HTTP.
- Let's Encrypt instantly becomes the certificate authority behind one of the largest single fleets of custom-domain sites, validating its free-issuance model at scale.
Second-order effects
- Rival managed hosts face a pricing problem: if HTTPS is free at WordPress.com, charging separately for SSL certificates or basic TLS becomes hard to defend, pushing security into the base tier across the hosting market.
- Browsers and search engines pushing encrypted-by-default get their largest supply-side assist yet, since a quarter-of-the-web CMS no longer leaves encryption to individual site owners.
Third-order effects
- Security plumbing keeps migrating from site-owner responsibility into the managed platform layer — the same pattern later visible in cryptographically signed core updates in WordPress 5.2 and Automattic's premium managed offerings like the 100-year domain registration bundle.
- If free automated issuance holds up at this scale, certificate sales as a product line erode toward zero and hosting differentiation shifts to what platforms manage on the owner's behalf.
The trend: Web hosting platforms are absorbing security infrastructure — certificates, signing, TLS — into the managed service itself, making encryption a default of the platform rather than a purchase by the site owner.