What is SSL? How to Install SSL on Thai Web Hosting 2026

SSL (Secure Sockets Layer) — now technically TLS (Transport Layer Security) — is an encryption protocol that secures data transmission between your website and its visitors. Sites with SSL display a padlock icon and "https://" in the browser address bar. If your website doesn't have SSL yet, this guide will walk you through everything you need to know and do.

What is SSL and How Does It Work?

SSL/TLS creates an encrypted "tunnel" between the user's browser and the web server. All data passing through this tunnel — passwords, credit card details, personal information — is encrypted so it cannot be intercepted or read by third parties while in transit. This process is known as the SSL/TLS Handshake.

Here's how the SSL Handshake works step by step:

• Step 1 — Client Hello: The browser sends a message to the server requesting an HTTPS connection, along with supported encryption methods.
• Step 2 — Server Hello + Certificate: The server responds with its SSL certificate for the browser to verify.
• Step 3 — Certificate Verification: The browser checks the certificate against trusted Certificate Authorities (CAs).
• Step 4 — Key Exchange: Both sides exchange keys to establish shared encryption parameters.
• Step 5 — Encrypted Session: All subsequent communication is encrypted using the agreed Symmetric Key.

The entire handshake takes only milliseconds. Once complete, your connection is secured with modern TLS 1.2 or TLS 1.3 encryption.

Why Every Website Needs SSL

In 2026, having SSL on your website is non-negotiable. Here are the key reasons:

1. Protects User Data

Without SSL, data submitted through forms — names, email addresses, passwords, credit card numbers — travels as plain text. Any attacker on the same network can intercept and read this data (a Man-in-the-Middle Attack). SSL encrypts everything so only the intended recipient can read it.

2. Google Search Rankings

Google officially confirmed in 2014 that HTTPS is a ranking signal. Websites with SSL generally rank better in search results, particularly when other SEO factors are equal. Core Web Vitals assessments also favor HTTPS-secured sites.

3. Browser Security Warnings

Chrome, Firefox, Safari, and Edge all display prominent "Not Secure" warnings for HTTP websites in the address bar. These warnings cause users to distrust your site, dramatically increasing bounce rates and reducing conversions. Studies show conversion rates drop 10-15% on sites with security warnings.

4. User Trust and Credibility

The padlock icon is now a basic expectation for any professional website. E-commerce sites, contact forms, login pages, and any site collecting user data absolutely must have SSL to maintain user trust.

5. PDPA Compliance (Thailand)

Thailand's Personal Data Protection Act (PDPA) requires organizations to implement appropriate security measures to protect personal data. Using SSL encryption is considered a fundamental security measure for PDPA compliance.

Types of SSL Certificates

SSL certificates are categorized by their validation level — how thoroughly the Certificate Authority verifies your identity before issuing the certificate.

Domain Validation (DV) SSL

The CA only verifies that you control the domain. Issues in minutes. Free (via Let's Encrypt) or very cheap. This is the most common type and perfectly adequate for blogs, informational websites, and most business sites.

Organization Validation (OV) SSL

The CA verifies both domain ownership and organizational identity (business registration, address, phone number). Takes 1-3 business days to issue. More expensive than DV. Suitable for businesses that want to demonstrate verified organizational identity.

Extended Validation (EV) SSL

The highest validation level with the most thorough identity verification. While EV previously displayed the company name in a green address bar, modern browsers have largely removed this visual indicator. Still provides the highest level of verification for fintech companies, banks, and large enterprises.

Wildcard SSL

Covers your main domain and all subdomains with a single certificate. For example, *.example.com covers blog.example.com, shop.example.com, mail.example.com, and any other subdomain. Cost-effective when managing multiple subdomains.

Multi-Domain (SAN) SSL

Covers multiple different domains in a single certificate — e.g., example.com, example.net, example.co.th. Reduces cost and management overhead for organizations managing multiple domain names.

Free SSL vs Paid SSL: Which Should You Choose?

The most common question from Thai hosting users: "Do I need to buy SSL, or is free good enough?"

Free SSL (Let's Encrypt)

• 100% free, no hidden costs
• Auto-renews every 90 days (most hosting panels handle this automatically)
• DV (Domain Validation) level
• Trusted by all major browsers
• Perfect for blogs, informational sites, portfolios, and most business websites
• Issued within minutes

Paid SSL (Comodo, DigiCert, Sectigo, etc.)

• Comes with a warranty (financial guarantee if certificate failure causes damages)
• OV and EV options available for higher identity verification
• Technical support from the Certificate Authority
• Wildcard and Multi-Domain options often more cost-effective than multiple Let's Encrypt certificates
• Price ranges from a few hundred to several thousand baht per year

Bottom line: For the vast majority of Thai websites and SMEs, free Let's Encrypt SSL is entirely sufficient. Purchase a paid SSL only if you specifically need: a warranty, OV/EV organizational validation, or cost-effective Wildcard coverage for many subdomains.

Installing SSL on DirectAdmin

DirectAdmin is the control panel used by many Thai hosting providers, including AsiaGB. Installing SSL through DirectAdmin is straightforward and requires no command line knowledge.

Installing Let's Encrypt on DirectAdmin (Step by Step)

1. Log in to your DirectAdmin control panel with your username and password.
2. Navigate to Advanced Features → SSL Certificates.
3. Select the tab labeled "Free & automatic certificate from Let's Encrypt".
4. Check the boxes for your domain and any subdomains you want to secure (typically example.com and www.example.com).
5. Click Save.
6. Wait 1-2 minutes for the system to automatically issue your certificate.
7. Verify by visiting https://yourdomain.com — you should see the padlock icon in the address bar.

Installing a Purchased SSL Certificate on DirectAdmin

1. Purchase your SSL certificate and receive your .crt and .key files from the provider.
2. In DirectAdmin → SSL Certificates → select "Paste a pre-generated certificate and key".
3. Paste your Certificate (.crt content) into the Certificate box.
4. Paste your Private Key (.key content) into the Key box.
5. If you received a CA Bundle file, paste it into the CA Certificate box as well.
6. Click Save and wait a few seconds for activation.

What is Let's Encrypt?

Let's Encrypt is a non-profit Certificate Authority (CA) that provides free SSL/TLS certificates to anyone who needs them. Founded by the Internet Security Research Group (ISRG) and backed by Mozilla, Google, EFF, and dozens of major technology companies, Let's Encrypt has been transformative in making SSL accessible to all.

Key advantages of Let's Encrypt:

• Completely free: No cost, no hidden fees, forever.
• Automated: Certificates auto-renew every 90 days. Most hosting control panels (including DirectAdmin) handle renewal automatically.
• Universally trusted: Recognized by all major browsers — Chrome, Firefox, Safari, Edge.
• Easy to use: Install through your hosting control panel with a few clicks.
• Secure: Full TLS 1.2/1.3 encryption support.
• Widely adopted: Secures hundreds of millions of websites worldwide.

Setting Up HTTP to HTTPS Redirect

After installing your SSL certificate, you need to configure automatic redirection from HTTP to HTTPS. Without this redirect, users who type http:// or click old links will still land on the insecure HTTP version of your site.

Method 1: DirectAdmin Built-in Option

DirectAdmin includes a "Force SSL with https redirect" checkbox on the SSL Certificates page. Check this option and click Save — the system creates the redirect automatically without any manual configuration.

Method 2: Via .htaccess (Apache)

Add these lines at the top of your .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This creates a permanent (301) redirect from all HTTP URLs to their HTTPS equivalents.

Method 3: WordPress Plugin

Install the Really Simple SSL plugin and click Activate. The plugin automatically configures redirects and fixes most mixed content issues. It's the simplest approach for WordPress sites.

Fixing Mixed Content Issues

Mixed Content occurs when a page loads over HTTPS but some resources — images, CSS files, JavaScript — are still referenced via HTTP URLs. Browsers block or warn about mixed content, potentially breaking your site's appearance and functionality.

How to Detect Mixed Content

• Open Chrome DevTools (F12) → Console — look for red warnings about insecure resources.
• Check the Security tab in DevTools for detailed certificate and mixed content information.
• Use online tools like whynopadlock.com or dnsxray.com for quick scanning.

How to Fix Mixed Content

• WordPress: Install Really Simple SSL or use Better Search Replace to change all http:// references to https:// in your database.
• Static HTML sites: Search and replace all http:// resource URLs with https:// in your source files.
• External resources: If a third-party resource doesn't support HTTPS, download and self-host it on your own server.
• Content Security Policy: Add Content-Security-Policy: upgrade-insecure-requests header to automatically upgrade mixed content requests.

How to Verify Your SSL Certificate

After installing SSL, always verify it's working correctly. Here are the tools and checks to perform:

Recommended Verification Tools

• SSL Labs (ssllabs.com/ssltest): The industry standard. Gives your SSL an A-F grade and checks for vulnerabilities, protocol support, and configuration issues.
• Why No Padlock (whynopadlock.com): Specializes in detecting mixed content issues.
• dnsxray.com: Thai-focused tool checking SSL, security headers, and DNS health together.
• Chrome DevTools Security Tab: View certificate details, expiry date, and mixed content warnings.

Checklist After SSL Installation

• SSL certificate issued for the correct domain (including www if needed)
• Certificate expiry date is reasonable (90 days for Let's Encrypt, 1 year for paid)
• Full chain of trust — no "Untrusted Certificate" warnings
• No mixed content errors
• HTTP to HTTPS redirect working (test both http://yourdomain.com and http://www.yourdomain.com)
• SSL Labs grade: aim for A or A+

Frequently Asked Questions