Enable HTTPS on your WordPress instance with a domain registered outside of Lightsail

Lightsail Setup helps you quickly connect your domain to your WordPress instance. Lightsail Setup creates a Let's Encrypt certificate that automatically renews every 60 to 90 days. When the setup is complete, visitors can securely access your website using your custom domain name.

This guide applies when your DNS is managed outside of Lightsail – for example, in a Route 53 hosted zone, Cloudflare, GoDaddy, or another DNS provider. It also applies if you have a domain registered outside of Lightsail and want to use Lightsail to manage your DNS.

If your domain is registered through Lightsail or Route 53 and managed using a Lightsail DNS zone, see Enable HTTPS on your WordPress instance with a Lightsail managed domain.

Step 1: Complete the prerequisites

Before starting Lightsail Setup, confirm the following:

• A running Lightsail WordPress instance. Your instance must be in a running state. If you don't have one, see Create an instance.

  

• A domain registered outside of Lightsail. Your domain is registered with a registrar other than Lightsail – for example, GoDaddy, Namecheap, or Cloudflare. The domain must be verified and active. If your domain is registered through Lightsail or Route 53, use Enable HTTPS on your WordPress instance with a Lightsail managed domain instead.

• Access to your DNS provider. You need the ability to create DNS records (A and AAAA) at the service that manages your domain's DNS. This could be a Route 53 hosted zone, Cloudflare, GoDaddy, Google Cloud DNS, or another provider. You can also use a Lightsail DNS zone to manage your DNS records – see Create a DNS zone to manage domain records.

• Ports 22, 80, and 443 are configured to enable Lightsail Setup. Port 22 is required for Lightsail Setup to connect to your instance. Port 80 is required for domain ownership validation during certificate installation. Port 443 is required for serving HTTPS traffic after setup. You can verify this on the Networking tab of your instance's management page. For more information, see Instance firewalls.

  

Step 2: Start Lightsail Setup

1. Open the Lightsail console at the Lightsail home page.

2. Choose your WordPress instance from the instance list.

   

3. Choose the Connect tab and choose Set up your website.

   

Step 3: Select your domain

Because your domain is registered outside of Lightsail, choose Third-party domain and enter your domain name (for example, example.com).

Choose Use this domain to continue.

Step 4: Configure DNS

A DNS provider manages the records that route traffic from your domain to your instance. Choose how you want to manage these records:

• Lightsail DNS zone – Lightsail manages DNS records for you.

  • If a Lightsail DNS zone already exists for your domain in the same account where your instance is set up – Lightsail Setup displays it. Choose Use this DNS zone.

    

  • If a DNS zone does not exist – Choose Create DNS zone. Lightsail Setup creates the DNS zone for your domain.

    

• Third-party DNS – Choose this if you are managing your DNS records with another provider (Route 53 hosted zone, Cloudflare, GoDaddy, and so on).

  

Step 5: Update name servers

Complete this step only if you chose Lightsail DNS zone in Step 4. If you chose Third-party DNS, continue to Step 6.

If you chose to use a Lightsail DNS zone, you need to update your domain's name servers at your registrar to point to the Lightsail name servers displayed in Lightsail Setup.

1. Copy the name servers displayed in the Lightsail Setup page.

   

2. Sign in to the website where you registered your domain (your registrar).

3. Find the name server settings for your domain and replace them with the Lightsail name servers you copied from Lightsail Setup.

4. Save your changes.

5. Return to the Lightsail Setup page and choose Continue.

Example: Updating name servers in GoDaddy

Note

The following example walks you through how to update your name servers in GoDaddy. For more information, see GoDaddy: Change my domain nameservers on the GoDaddy website.

1. Sign in to your GoDaddy Domain Portfolio.

2. Select your domain to access the Domain Settings page.

   

3. Select DNS and then select Nameservers.

4. Select Change Nameservers.

   

5. Replace the existing name servers with the Lightsail name servers displayed in Lightsail Setup.

6. Select Save.

Note

The exact steps for updating name servers vary by registrar. Refer to your registrar's documentation for guidance:

• Namecheap: Change DNS for a domain on the Namecheap website.

• Cloudflare: Update nameservers on the Cloudflare website.

Name server changes can take up to 48 hours to propagate. If Lightsail Setup fails after updating name servers, wait and try again.

Step 6: Configure a static IP

A static IP address provides a fixed public IP for your instance. Without a static IP, your instance's IP address can change if you stop and restart it, which breaks your domain's connection.

Choose one of the following:

• Create a new static IP – Enter a name for your static IP and choose Create static IP.

  

• Use an existing static IP – If you have an unattached static IP in the same AWS Region, select it from the list and choose Attach static IP.

  

After this step, Lightsail Setup attaches the static IP to your instance and displays the IP addresses you need for DNS configuration.

Step 7: Create DNS records

This step appears if you chose Third-party DNS in Step 4. If you chose Lightsail DNS zone, continue to Step 8.

Lightsail Setup displays the IPv4 and IPv6 addresses that your domain must resolve to. You need to create DNS records at your DNS provider pointing your domain to these addresses.

Keep the Lightsail Setup page open – you return to it after creating your records.

If your DNS is managed by another provider (GoDaddy, Cloudflare, and so on)

1. Sign in to your DNS provider's management console.

2. Navigate to the DNS records section for your domain.

3. Create an A record for your root domain (example.com) with the value set to the static IPv4 address displayed in Lightsail Setup.

4. Create an AAAA record for your root domain (example.com) with the value set to the IPv6 address displayed in Lightsail Setup.

5. (Optional) Repeat steps 3–4 for your www subdomain (www.example.com).

Example: Adding A and AAAA records in GoDaddy

Note

The following example walks you through how to add A and AAAA records in GoDaddy. For more information, see GoDaddy: Manage DNS records on the GoDaddy website.

1. Sign in to your GoDaddy Domain Portfolio.

2. Select your domain to access the Domain Settings page.

3. Select DNS to view your DNS records.

4. Select Add New Record and then select A from the Type menu.

5. Enter the following:

   • Name: @ (for your root domain)

   • Value: The static IPv4 address displayed in Lightsail Setup

   • TTL: 1 hour (default)

6. Select Add another record and select AAAA from the Type menu.

7. Enter the following:

   • Name: @ (for your root domain)

   • Value: The IPv6 address displayed in Lightsail Setup

   • TTL: 1 hour (default)

   

8. Select Save.

9. (Optional) Repeat steps 4–8 for your www subdomain, entering www in the Name field.

Note

The exact steps for creating DNS records vary by provider. Refer to your provider's documentation for guidance on adding A and AAAA records:

• Cloudflare: Manage DNS records on the Cloudflare website.

• Namecheap: Set up an A record on the Namecheap website.

Step 8: Verify DNS and manage domain assignments

Manage domain assignments

This step appears if you chose Lightsail DNS zone in Step 4. If you chose Third-party DNS, continue to Verify your name servers and DNS records.

Domain assignments are DNS records that direct traffic for your domain to your instance. Lightsail creates these records for you automatically.

1. Choose Add assignment.

2. Add your root domain (for example, example.com).

3. (Optional) Add your www subdomain (for example, www.example.com).

4. Choose Continue.

Tip

If you skip the www subdomain, visitors who type www.example.com will not reach your site.

Verify your name servers and DNS records

This step appears if you chose Third-party DNS in Step 4. Before proceeding, confirm the following:

1. Your domain's name servers point to the correct DNS provider. They must point to the same provider where you created your A and AAAA records. If they don't match, traffic does not reach your records and Lightsail Setup fails.

   To verify your name servers, use NS Lookup on the dnschecker.org website.

   You can also verify from the command line:

   • macOS and Linux:

     $ dig NS example.com +short

   • Windows:

     C:\> nslookup -type=NS example.com

   For example, if you created records in GoDaddy, the result should show GoDaddy name servers. If you created records in Route 53, the result should show awsdns-* name servers. If the result shows a different provider, update your domain's name servers at your registrar before continuing.

2. Your DNS records resolve to the correct IP addresses.

   To verify global propagation, check DNS Checker on the dnschecker.org website.

   You can also verify from the command line:

   • macOS and Linux:

     $ dig example.com A +short
     $ dig example.com AAAA +short

   • Windows:

     C:\> nslookup -type=A example.com
     C:\> nslookup -type=AAAA example.com

   The A queries should return your instance's static IPv4 address. The AAAA queries should return your instance's IPv6 address. Both should match what Lightsail Setup displayed.

Important

DNS changes can take anywhere from a few minutes to 48 hours to propagate. Do not proceed to certificate creation until all records resolve to the correct addresses. If you proceed before your DNS changes have fully propagated, your SSL/TLS certificate will fail to validate because Lightsail can't confirm that you control the domain. If the commands do not return the expected values, wait and try again.

Step 9: Create SSL/TLS certificate

Create certificate

1. Enter the domains and subdomains you want to secure with HTTPS. Because your domain is registered outside of Lightsail, you enter these manually (for example, example.com and www.example.com). You can secure up to 10 domains and subdomains.

2. Enter your email address. This is used for certificate renewal notifications.

3. Select I authorize Lightsail to configure a Let's Encrypt certificate on my instance. This gives Lightsail restricted access to create and configure the certificate on your instance.

4. Choose Create certificate.

Lightsail Setup begins configuring HTTPS on your instance. This process takes up to 15 minutes.

If setup fails, see Lightsail Setup failed for troubleshooting steps.

Important

Do not stop, reboot, or modify your instance while setup is in progress.

Step 10: Verify your website

After Lightsail Setup completes:

1. Open your browser and go to https://yourdomain.com.

2. Confirm that your website loads successfully.

3. Test each additional domain and subdomain that you secured in the certificate (for example, https://www.yourdomain.com) to confirm they all load successfully over HTTPS.

4. Test the automatic redirect from HTTP to HTTPS. In your browser, go to http://yourdomain.com and confirm that the address automatically redirects to https://yourdomain.com.

Your website is now configured with HTTPS and an automatic redirect from HTTP to HTTPS.

Note

Let's Encrypt certificates automatically renew every 60 to 90 days. If renewal fails in the future, see Certificate did not automatically renew.

Learn more

• Understanding DNS in Lightsail

• Register and manage domains

• Create a DNS zone to manage domain records

• Instance firewalls

• Static IP addresses