Shared hosting, SSL and WordPress

Everything on this page comes from running a handful of small sites on one shared cPanel account — the kind of setup where you have SSH, no root, a fixed PHP version, and a support ticket queue between you and anything else. It is a genuinely constrained environment, and most advice written for a VPS quietly assumes away the constraints that define it.

SSL and certificates

The certificate problem on shared hosting is not issuing. Issuing is solved, free, and takes two commands. The problem is everything after: a certificate renews on disk for years while the server keeps serving the old one, and the renewal log looks clean the entire time.

That happened here. A domain was added to the account without the deploy hook that installs the renewed certificate through cPanel’s API, so acme.sh dutifully renewed it every sixty days into a directory nothing read. Nothing alerts on that. There is no error state — the renewal succeeded, and the visitor got an expired certificate.

The lesson generalises past cPanel: a certificate lifecycle has two halves, and only the first one is automated by default. Issuance is a solved problem; deployment and the proof that deployment happened are what you actually have to build. If you run more than two or three domains, that gap is where the outage comes from.

Free auto-renewing Let’s Encrypt SSL on Namecheap cPanel is the setup itself, and still the most-read thing on this site.

WordPress on shared hosting

The other half is WordPress, and specifically the failures that only happen because of where it is running rather than what it is doing. An editor that reports “Updating failed. The response is not a valid JSON response” is not a WordPress bug — it is the host’s security layer eating a REST request, and no amount of plugin-disabling finds that. Build tooling has the same shape: a node-sass version that is fine locally and incompatible with whatever the host pinned, or an official Docker image that ships without the one binary your build step needs.

These are collected here because the answer is almost never in the application’s own documentation.

What is not here

Nothing about choosing a host, and no referral links. This is one account, one control panel, and the specific things that broke on it.