Does my 10DLC website need SSL and HTTPS?

HTTPS is the secure version of a web address. When a site uses it, the address starts with https:// and browsers show a padlock. It needs an SSL certificate, which proves the site belongs to your domain and encrypts what visitors send, like the phone number on your opt-in form. For 10DLC, some providers write HTTPS into their rules. Others do not say it directly, but a site that throws a security warning is hard for anyone to review.

Which providers say this?

We did not find a written HTTPS rule from every provider, so we are not saying all of them require it. It is still the safe choice.

How do SSL and HTTPS work, in plain words?

1. Your host installs an SSL certificate for your domain.
2. When someone visits, their browser checks the certificate is valid and matches the domain.
3. If it checks out, the page loads over https with a padlock.
4. If the certificate is missing, expired, or for a different domain, the browser shows a warning page instead.

Certificates have an end date. Many hosts renew them automatically, but if renewal fails, your site can suddenly show a warning.

What is the HTTPS checklist for 10DLC?

1. Your homepage loads at https://yourdomain.com with no warning.
2. http:// addresses redirect to https://.
3. The www and non-www versions both work, or one redirects to the other on the same domain.
4. Your privacy policy URL starts with https://.
5. Your terms URL starts with https:// (Twilio 30934).
6. Your opt-in page loads over https.
7. Links in sample messages use full https links on your own domain, not public shorteners (Twilio 30892, TCR).
8. Certificate auto-renewal is turned on.
9. No "mixed content": images, scripts, or forms on the page also load over https.

What problems break HTTPS?

• Expired certificate. The browser blocks the page with a warning.
• Wrong domain on the certificate. For example, it covers www but not the bare domain.
• Mixed content. An https page loads an image or form from an http address, which can show a "not fully secure" notice or break the form.
• No redirect. The http version loads without the padlock, and someone pastes that URL into the form.
• Redirect to another domain. Twilio's business info guide says the site must not redirect to an unrelated brand or domain.

How can I check my site?

1. Open your homepage, privacy, terms, and opt-in pages in a private browser window.
2. Look for the padlock and https:// on each.
3. Click the padlock to see the certificate's expiry date.
4. Type http:// in front of your domain and confirm it moves you to https://.
5. Try it on your phone too, since reviewers may use different devices.

How does 10DLC Site handle it?

Every site we build runs on HTTPS with an SSL certificate included. All pages, including the privacy policy, terms, and opt-in form, load over https, and the URLs we give you all start with https://. Compliance Watch checks your SSL certificate daily and alerts you if something changes.

Sources

• Plivo A2P 10DLC registration guidelines
• Twilio error 30892
• Twilio error 30934
• Twilio error 30922
• Twilio changelog: privacy policy and terms URLs required
• The Campaign Registry CSP User Guide (October 2025)
• Vonage 10DLC Campaign requirements

Want a quick look at your site's HTTPS setup? Check your site free, or see pricing.