How to Enable SSL on Squarespace, Solve Certificate Unavailable, Processing, Not Working Error 2026

From your Squarespace dashboard, go to Settings, then Developer Tools, then SSL; it's easy to miss because it isn't grouped with Domains & Email, where most people look first for anything domain-security related. At the top of the SSL page, Certificate Status should read Active if Squarespace has already issued a certificate for your connected domain. If it reads Unavailable or Processing instead, the certificate hasn't finished issuing, and the Security Preference below won't matter until that resolves.

Below the certificate status, Squarespace gives three options. Secure (Preferred) directs search engines to index the HTTPS version of your site and automatically redirects visitors from the insecure URL; Squarespace's own documentation calls this the setting almost every site should use.

HSTS Secure goes further, forcing browsers to only load the secure version and helping prevent downgrade attacks, and Squarespace's help center recommends enabling it together with Secure instead of waiting. Insecure is meant for legacy domains registered or connected before October 2016; it leaves both HTTP and HTTPS versions live and indexable, which is the configuration behind most missing-padlock complaints.

Click the radio button next to Secure (Preferred), then click Save in the top-right corner. The change applies immediately to new requests, but if your site was previously running Insecure, give it a little time for cached versions of your pages to clear out of search engines and browsers. Once saved, load your site in a fresh browser tab and confirm you see the padlock icon and an automatic redirect if you try to load the plain HTTP version of a page.

Squarespace's own troubleshooting guidance splits this by where the domain is registered. For a domain bought through Squarespace, check that the default DNS records under Domains & Email are still intact; something removing them is the usual cause. For a domain registered elsewhere, confirm its DNS records match Squarespace's connection instructions exactly, and also check whether your registrar has a CAA record restricting which certificate authorities can issue certificates for the domain; Squarespace specifically flags this as a reason issuance can fail even with otherwise correct DNS.

Squarespace's documentation puts the window at up to 48 hours after connecting a domain or changing DNS, not longer. During that time, Certificate Status reads Processing and the Security Preference options may be greyed out; that's expected, not a sign of failure. Changing DNS settings again mid-wait restarts that clock, so leave them alone once they're correct.

Once status shows Active and Secure is selected, test the site on desktop and mobile, ideally from a network you don't normally use, since local DNS caching can make a fixed site look broken to you longer than to everyone else. Look for the padlock in the address bar and try loading a plain http:// page to confirm it redirects to https:// automatically. If it still doesn't, and the certificate is genuinely Active, Squarespace's troubleshooting guide also points at the visitor's browser: one that doesn't appear on Let's Encrypt's list of platforms trusting ISRG Root X1 won't show the site as secure regardless of your settings.