Hiring help with SSL: when it is worth it and how to do it safely

The short version

• Most sites never need to hire anyone. Website builders and most hosts set up a free SSL certificate and renew it for you. Ask their support first: it costs nothing.
• Hiring makes sense for a custom server, a wildcard certificate on DNS you do not control, or errors that come back after you have tried the fixes.
• Upwork’s own guide puts web developers at $15 to $50 an hour (median rates). On top of that, Upwork charges clients up to 7.99% and Fiverr charges buyers 5.5%, plus $3.50 on orders under $200.
• Never share your password. Invite the helper as a user on your host, DNS provider or registrar, and remove them when the job is done.

Try free help first

An SSL certificate is the file that lets your site load over HTTPS, with the padlock instead of “Not secure”. (More on how it works in our HTTPS and TLS entry.) On most platforms, you do not install it yourself:

• Website builders. Wix, Squarespace and Shopify add a free certificate automatically once your domain points to them. Shopify says a certificate for a domain bought elsewhere can take up to 48 hours, and Wix says to allow up to 48 hours after DNS changes.
• Web hosts. All 10 hosts in our web hosting comparison list free SSL. Most issue and renew it automatically, often through Let’s Encrypt.

If the padlock is missing, open a support ticket with your builder or web host before you pay anyone. Our SSL error fixes guide covers the common problems step by step, and SSL by platform shows what each builder and host does for you.

When hiring is worth it

• You run your own server. On a VPS or cloud server you manage, nobody sets up automatic renewal unless you do. A helper can install it once so it renews by itself.
• You need a wildcard on DNS you do not control. A wildcard covers every subdomain, such as shop.example.com and blog.example.com. Let’s Encrypt only issues wildcards through a DNS check, so whoever sets it up needs access to your DNS records. Some hosts do not offer free wildcards at all: Hostinger supports them only on VPS plans, DreamHost does not support them, and WP Engine needs a third-party certificate.
• Errors keep coming back. If the certificate expires every few months, or the site loops with “too many redirects”, something in the setup is wrong. One paid fix can save repeat outages.
• Several companies are involved. For example, the domain is at one registrar, DNS is at Cloudflare and the site is on a third company’s server. A helper who knows all three can save you a lot of back and forth.

What it costs

The certificate itself is usually free. You pay for the person’s time, plus the marketplace fee.

Upwork’s figures cover web developers in general, not SSL work, and its by-level figures describe web developer pay overall, not only on Upwork. Two worked examples: two hours at $30 an hour on Upwork is $60, plus a fee of up to $4.79, so up to $64.79. A $50 order on Fiverr adds $2.75 plus $3.50, so $56.25.

If a helper says you need to buy a certificate, check the price yourself. Namecheap’s Standard SSL (a basic DV certificate) is $11.00 for 1 year. Our free vs paid SSL guide lists the rest.

What to ask before you hire

1. Where will the certificate come from, and is it free? A good answer names the source: your host’s free SSL, Let’s Encrypt, Cloudflare or a paid certificate with a reason.
2. How will it renew? Certificates issued now can last at most 200 days. That drops to 100 days from March 15, 2027 and to 47 days from March 15, 2029, as of October 2026. Manual renewal will not keep up, so ask for automatic renewal.
3. Which names will it cover? Usually example.com and www.example.com. Add any subdomains you use.
4. Will you change my DNS records? Ask which records, and ask for a list of the old values first so they can be put back.
5. What access do you need, exactly? A clear answer is something like “DNS for one domain” or “your hosting control panel”, not “your login”.
6. What will you hand back? Ask for a short written note: what changed, where the certificate comes from and how renewal works.

How to give access safely

1. Do not send your password. Your password also opens billing, your domain and often your email. If you already shared it, change it when the job ends.
2. Use the provider’s invite feature. Most providers let you add a second person with their own login. Four examples from their help pages are below.
3. Give the smallest access that works. One domain instead of the whole account. DNS only, if DNS is all they need.
4. Remove access when the job is done. Each provider below lets you remove the person at any time.
5. Not listed here? Ask your host or registrar’s support whether it has a team, user or delegate feature before you share anything.

• Cloudflare: members. You invite a member by email, and each permission can cover the whole account or just one domain. Cloudflare’s members guide
• GoDaddy: delegate access. You invite a delegate, such as your web designer, to your GoDaddy products. GoDaddy says delegates cannot view or change your payment methods and passwords. GoDaddy’s delegate guide
• Namecheap: Share Access. You hand over part of a domain’s settings, for example just DNS management. The helper needs their own Namecheap account, and Share Access does not cover Namecheap’s SSL service. Namecheap’s Share Access guide
• SiteGround: collaborators. You add a collaborator for one site. SiteGround says collaborators cannot see your billing details, personal information or private support history. SiteGround’s collaborator page

On a self-hosted WordPress site, give the helper their own user account rather than yours, and delete it afterward. We build on WordPress every week, and this is the simplest way to see who changed what.

Red flags

• “You need an EV certificate for SEO.” EV (Extended Validation) means the certificate authority checked that your business legally exists. The EV Guidelines say EV certificates focus only on the identity of the business named in them. It also costs real money: Namecheap’s EV SSL is $76.99 for 1 year, and GoDaddy’s EV SSL is $10.42 a month on a 3-year term (GoDaddy’s page shows no renewal price). See SSL certificate types.
• They ask for your password instead of an invite, or want the domain moved into their own account.
• No plan for renewal. A certificate installed by hand, with no automatic renewal, will expire. Even multi-year purchases need fresh certificates: Namecheap says its certificates should be reissued (free) every 200 days, and ZeroSSL says its annual certificates must be renewed by day 199.
• “Just switch Cloudflare to Flexible.” It can hide the warning, but traffic between Cloudflare and your server is then not encrypted, and it can cause redirect loops. Ask for Full (strict) instead; SSL by platform explains the modes.
• A big quote for a builder site. On Wix, Squarespace or Shopify, SSL is automatic once the domain points correctly. A fix there is usually a DNS change, not hours of work.

New to all this? Start at our SSL certificates hub.

Sources: Upwork web developer cost guide, Upwork WordPress developer cost guide, Upwork client marketplace fee, Fiverr: paying for orders, Fiverr gig pricing, CA/Browser Forum Baseline Requirements, EV Guidelines, Cloudflare encryption modes, Cloudflare redirect loops, Let’s Encrypt FAQ, Cloudflare members, GoDaddy delegate access, Namecheap Share Access, Namecheap Share Access limits, SiteGround collaborator management, SiteGround collaborator access, Namecheap Standard SSL, Namecheap EV SSL, GoDaddy EV SSL, Namecheap reissue note, ZeroSSL pricing, Hostinger wildcard, DreamHost SSL, WP Engine SSL, Wix SSL, Squarespace SSL, Shopify SSL.