diff --git a/ChangeLog.md b/ChangeLog.md
index d60effc..36db792 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -7,6 +7,8 @@ repository history](https://github.com/ddclient/ddclient/commits/master).
 
 ### Breaking changes
 
+  * The `--ssl` option is now enabled by default.
+    [#705](https://github.com/ddclient/ddclient/pull/705)
   * Unencrypted (plain) HTTP is now used instead of encrypted (TLS) HTTP if the
     URL uses `http://` instead of `https://`, even if the `--ssl` option is
     enabled.  [#608](https://github.com/ddclient/ddclient/pull/608)
diff --git a/ddclient.conf.in b/ddclient.conf.in
index 65a9650..19df639 100644
--- a/ddclient.conf.in
+++ b/ddclient.conf.in
@@ -18,9 +18,8 @@
 ######################################################################
 
 ## Use encryption (TLS) when the scheme (either "http://" or "https://") is
-## missing from a URL.  Defaults to "no" for compatibility reasons, but you are
-## strongly encouraged to set this to "yes".
-ssl=yes
+## missing from a URL.  Defaults to "yes".
+#ssl=yes
 
 daemon=300				# check every 300 seconds
 syslog=yes				# log update msgs to syslog
diff --git a/ddclient.in b/ddclient.in
index 82ace95..7c06024 100755
--- a/ddclient.in
+++ b/ddclient.in
@@ -604,7 +604,7 @@ our %variables = (
         'timeout'             => setv(T_DELAY, 0, 0, interval('120s'),     interval('120s')),
         'retry'               => setv(T_BOOL,  0, 0, 0,                    undef),
         'force'               => setv(T_BOOL,  0, 0, 0,                    undef),
-        'ssl'                 => setv(T_BOOL,  0, 0, 0,                    undef),
+        'ssl'                 => setv(T_BOOL,  0, 0, 1,                    undef),
         'syslog'              => setv(T_BOOL,  0, 0, 0,                    undef),
         'facility'            => setv(T_STRING,0, 0, 'daemon',             undef),
         'priority'            => setv(T_STRING,0, 0, 'notice',             undef),